On Aug 9, automated market maker Curve Finance took to Twitter to warn users of an ongoing exploit on its site. The team behind the protocol noted that the issue, which appears to be an attack from a malicious actor, was affecting the service’s nameserver and frontend.
Don't use https://t.co/vOeMYOTq0l site - nameserver is compromised. Investigation is ongoing: likely the NS itself has a problem
— Curve Finance (@CurveFinance) August 9, 2022
Curve stated via Twitter that its exchange — which is a separate product — appeared to be unaffected by the attack, as it uses a different DNS provider. The team still encouraged users to exercise caution when interacting with the site, however.
Although you need to proceed with caution, but https://t.co/6ZFhcToWoJ seems to be unaffected - uses a different DNS provider
— Curve Finance (@CurveFinance) August 9, 2022
Twitter user LefterisJP speculated that the alleged attacker had likely utilized DNS spoofing to execute the exploit on the service:
It's DNS spoofing. Cloned the site, made the DNS point to their ip where the cloned site is deployed and added approval requests to a malicious contract.
— Lefteris Karapetsas | Hiring for @rotkiapp (@LefterisJP) August 9, 2022
Other participants in the DeFi space quickly took to Twitter to spread the warning to their own followers, with some noting that the alleged thief appears to have stolen more than $573K USD at time of publication.
Alert to all @CurveFinance users, their frontend has been compromised!
— Assure DeFi (@AssureDefi) August 9, 2022
Do not interact with it until further notice!
It appears around $570k stolen so far #defi #crypto $crv
Back in July, analysts suggested that they were favorably eying Curve Finance, despite the market downturn which continues to affect the larger DeFi space. Among the reasons cited by researchers at Delphi Digital for their bullishness, they specifically called out the platform's yield opportunities, the demand for CRV deposits, and the protocol's revenue generation from stablecoin liquidity.
This followed the platform's release of a new “algorithm for exchanging volatile assets” in June, which promised to allow low-slippage swaps between “volatile” assets. These pools use a combination of internal oracles relying on Exponential Moving Averages (EMAs) and a bonding curve model, previously deployed by popular AMMs such as Uniswap.
This story is in development, and will be updated as more information becomes available.