Minswap Handles a Smart Contract Vulnerability during Recent Maintenance
On March 22, Minswap announced on Twitter that its system would be undergoing a maintenance session to improve user experience. Additionally, it mentioned on March 25 about a smart contract vulnerability reported during its smart contract audits. While nothing went wrong before this, the platform understands the risk of what the bug could have meant for its user funds.
Minswap Vulnerability Report
According to the report, the bug would have been a liability to the liquidity pool tokens, where an attacker could breach and get away with the funds. The decentralized exchange built on the Cardano network utilizes the MIN/ADA pair for its liquidity provision. Once its team pointed out the nature of the vulnerability, it leveraged the same to transfer users to a more secure smart contract, after fixing the bug.
Minswap explained to its users that the transformation of its smart contracts to open-source was the reason behind the vulnerability. However, it recognizes open-source nature as the key to its progression in the future.
It also stated that one of the central objectives of the Cardano community is to provide avenues for future developers to come up with better applications from open-source code. The blockchain stands as an innovative stop for decentralized solutions for different problems in the real world and more.
Solving the Vulnerability Issue
The Minswap team explained that the bug would allow a cyber-attacker to gain access and mint NFT tokens from the liquidity pool. In turn, they could mint other liquidity pool tokens infinitely from the duplicate NFT tokems. To prevent any of that from happening, the DEX took steps to block the vulnerability, securing user funds before finding a more permanent solution.
During the maintenance, the platform wrote a new contract code to patch the vulnerability for good. Next came the migration of the staking and liquidity pool users to the new smart contract. Mimswap revealed that the vulnerability came in handy for the process of moving liquidity and creating new pools, distributing new LP tokens for its community according to previous records. Notably, every individual maintained their position in the new contract to ensure a smoother transition.
Minswap also revamped its security to prevent any other possible breaches from happening, including through preventing permissionless new pool creation. Nonetheless, it hopes with the upcoming upgrades of its v2 will present a better decentralized model for its community.
DeFiance Capital in Phishing Scam
Minswap is among the platforms that go unscathed in possible scam situations. In spite of this, others are not very lucky, including DeFiance Capital which suffered a phishing scam and lost millions in investment. Its founder Arthur Cheong lost about $1.7 million worth of digital assets, while the attacker got away with an additional $720 000 in Lido tokens.
They went ahead to attack vested tokens worth over $13 million. Nonetheless, the attacker could not access the tokens due to the linear vesting nature of the contract. This incident shows the increased need for care when dealing with smart contracts and user funds in general.
