user funds

Binance Rejects Wazirx’s Claims — Denies Responsibility for Hack Consequences

September 18, 2024 Bitcoin.com

Wazirx Fast-Tracks INR Withdrawals but Users Face 6-Month Crypto Trading Delay

September 4, 2024 Bitcoin.com

Lido assures LDO, stETH tokens remain safe despite flaw in token contract

September 11, 2023 Coin Telegraph

The “fake deposit” attack enables bad actors to execute a transfer where the requested value is larger than what the user actually owns.

Ethereum staking protocol Lido Finance has assured both Lido DAO (LDO) and staked-Ether (stETH) tokens remain safe despite hackers allegedly exploiting a known security flaw in LDO’s token contract.

Lido didn’t confirm any exploits, but acknowledged the security flaw was known and reassured LDO and stETH funds remain safe in response to a Sept. 10 post by blockchain security firm SlowMist.

SlowMist said LDO’s flawed token contract allows bad actors to facilitate “fake deposit” attacks on exchanges because LDO’s token contract enables users to execute transactions even where they don’t have sufficient funds. This code deviates from the Ethereum Request for Comment 20 (ERC-20) token standard, according to SlowMist.

However, Lido Finance argued the flaw is built into all ERC-20 tokens — not just Lido’s LDO token:

This behaviour is expected and conforms to the ERC20 token standard (see tweet below). Both LDO and stETH (and Lido governance) remain safe.

Lido token integration guides will be updated with LDO specifics to make this more visible shortly.
— Lido (@LidoFinance) September 10, 2023

SlowMist said the “fake deposit” attacks came from LDO’s token contract executing transfers where the value is larger than what the user actually owns, triggering a false return as opposed to reverting the transaction. While the firm said Lido's token contract has recently been exploited via this attack, no on-chain evidence was provided.

Cointelegraph reached out to SlowMist for comment but did not receive an immediate response.

Meanwhile, on-chain analyst “Hercules” explained on Sept. 10 that the security flaw may not be picked up by cryptocurrency exchanges.

SlowMist recommends LDO holders to also check the return values of the token contract transfers in addition to the success or failure of a transaction.

The blockchain security firm concluded that token contract implementations and behaviors vary by project and to conduct comprehensive testing before integrating any new tokens.

However, Lido highlighted in the official Ethereum Improvement Proposal document — co-authored by Vitalik Buterin in November 2015 — that both the “transfer” and “transferFrom” functions must return the transfer status and are only recommended to revert a transaction in exceptional cases.

ERC20 token standard: https://t.co/YlrS1ZN6Fd

1) Both transfer and transferFrom are required to return transfer status and are only recommended to revert a tx in exceptional cases.

2) The standard says that a caller is obliged to check the return status (see 'Token methods'). pic.twitter.com/6KTcIyxo2F
— Lido (@LidoFinance) September 10, 2023

To resolve the security flaw, Lido confirmed the LDO token integration guides will soon be updated.

Magazine: DeFi Dad, Hall of Flame: Ethereum is ‘woefully undervalued’ but growing more powerful

Bybit Halts US Dollar Deposits via Bank Transfer Due to Service ‘Outages’ From Partner

March 4, 2023 Bitcoin.com

FTX warns it will claw back political donations and contributions

December 20, 2022 Coin Telegraph

bankrupt

The exchange warned those who received payments from FTX or its former executives that it's looking to recover funds even if they were donated to charity.

Bankrupt cryptocurrency exchange FTX says it is considering using legal avenues to recover all payments and contributions handed out by its associated entities and former executives, which could include the millions in political donations made from its former CEO Sam Bankman-Fried.

In a Dec. 19 press statement, FTX said it had already “been approached by a number of recipients of contributions or other payments” that were made by, or at the direction of Sam Bankman-Fried or other officers, adding those entities have sought “directions for the return of such funds.”

Sharing our press release just issued: FTX Debtors Announce Process for Voluntary Return of Avoidable Payments https://t.co/l57F7zgKPJ
— FTX (@FTX_Official) December 19, 2022

Just last week, three prominent Democratic organizations pledged to return over $1 million worth of Bankman-Fried’s political donations on Dec. 16, following Bankman-Fried’s arrest and indictment.

Days earlier on Dec. 13, a press secretary for the White House was asked whether the Biden administration would return the $5.2 million in campaign donations previously given by Bankman-Fried but refrained from answering at the time.

In its recent statement, FTX invited those who received funds to “make arrangements for the return of such payments” warning if they weren’t returned voluntarily it would commence legal action in court to claw back the payments with interest.

Legal experts previously warned up to $73 million worth of FTX’s political donations could be targeted for recovery to repay the speculated one million creditors owed up to an estimated $10 billion to $50 billion in its bankruptcy case.

Meanwhile, some members of the United States Congress on the receiving end of FTX’s political contributions have reportedly donated the funds to charity in a bid to distance themselves from the exchange and its founder.

Members of Congress such as the Democratic leader in the U.S. House, Hakeem Jeffries and Senate Democrat whip, Dick Durbin have reportedly donated money received from FTX to various charitie.

Republican Senator John Hoeven similarly donated the $11,600 he received from Bankman-Fried and Salame to the Salvation Army.

However, FTX said these charitable offloads won’t be enough to stop it from coming after the funds, stating:

“Making a payment or donation to a third party (including a charity) [...] Does not prevent the FTX Debtors from seeking recovery.”

Bankman-Fried was the second-largest Democratic Party contributor with $36.8 million wired to candidates in the 2022 mid-term elections. He also funneled $5.2 million to Joe Biden’s 2020 U.S. presidential campaign becoming its second-largest “CEO-contributor.”

The FTX founder claimed in a Nov. 16 interview with crypto vlogger Tiffany Fong to have “donated about the same to both parties" but his donations to Republicans were “dark.”

Other FTX executives such as Ryan Salame donated around $20 million to Republican candidates and Nishad Singh donated at least $500,000 to the Oregon Democrats.

On Dec. 13 Bankman-Fried was charged with violations of campaign finance laws including contribution violations and obstructing the Federal Election Commission’s functions along with making contributions in the name of others.

Share this video