The Flow Foundation published a technical postmortem on Tuesday detailing a protocol-level exploit that occurred on December 27, when an attacker managed to forge tokens on the network, leading to confirmed losses of roughly $3.9 million before the exploit was contained.
According to the report, the attacker exploited a flaw in Flow's Cadence runtime environment that allowed certain assets to be duplicated reasonably than minted, thereby bypassing supply controls without accessing or debiting existing user balances. Validators coordinated a network shutdown inside six hours of the primary malicious transaction, while exchange partners froze most counterfeit assets before they might be sold.
Flow said the temporary stop placed the network in a read-only mode to separate output paths and forestall further duplication while the problem was investigated. Operations resumed two days later under an “isolated recovery plan” that preserved legitimate transaction history and authorized the recovery and everlasting destruction of counterfeit assets through a government-approved process.
Source: Flow Blockchain
The Flow Foundation, which supports the Flow network, said no existing user balances were in danger since the exploit duplicated assets reasonably than removing funds from accounts. A limited variety of accounts that interacted with counterfeit tokens were temporarily restricted as a precautionary measure, while greater than 99% of accounts retained full access during and after recovery.
While the attacker generated a considerable amount of fake tokens on-chain, Flow said the overwhelming majority were contained or frozen before liquidation.
The foundation said it has since fixed the underlying vulnerability, added stricter runtime checks and enhanced regression testing to forestall similar exploits. The company can be working with forensic partners and law enforcement agencies and plans to strengthen monitoring and bug bounty programs as a part of a broader security strengthening.
Flows downturn after NFT
Dapper Labs, the creators of the non-fungible token project CryptoKitties, announced in September 2019 the event of Flow as a brand new Layer 1 blockchain designed to handle scalability challenges faced by consumer applications equivalent to games and digital collectibles.
Early success with NBA Top Shot, an NFT platform for trading officially licensed NBA video highlights, helped bring mainstream attention to the Flow blockchain in 2020 and 2021. Against this backdrop, the network's FLOW token rose to over $40 in 2021, in response to data from CoinGecko.
Flow's momentum continued into 2022, where the project raised roughly $725 million from investors including Andreessen Horowitz (a16z) and Union Square Ventures to support the event of the ecosystem.
As activity within the NFT market cooled down in the next years, the FLOW token also lost momentum and has since fallen out of the list of the highest 300 largest cryptocurrencies by market capitalization.
The decline accelerated after the Dec. 27 hack, when FLOW plunged about 40% in five hours.
The token later fell to a low of $0.075 on January 2 before beginning to get better. According to data from Cointelegraph, on the time of writing, it was trading at around $0.10, up around 16% within the last 24 hours.
Source: CoinGecko
