Recently, the DeFi lending protocol Akropolis was attacked by cyber hackers. Akropolis founder and CEO Ana Andrianova said the attackers used flash loans on derivatives platform dYdX to carry out a reentrancy attack, causing a loss of $2 million.

After receiving an alarm from the self-developed blockchain security situational awareness platform (Beosin-Eagle Eye), the Chengdu Lianan team immediately investigated the attack and found that:

1. Akropolis was indeed attacked

2. The attack contract address is

0xe2307837524db8961c4541f943598654240bd62f

3. The attack method is re-entry attack

secondary title

Attack Method Analysis

Reference link:

Figure 1

Figure II

Reference link:https://etherscan.io/tx/0xddf8c15880a20efa0f3964207d345ff71fbb9400032b5d33b9346876bd131dc2

Figure three

Figure three

Figure four

Figure four

Figure five

Figure five

image description

Event summary

Event summary

As a DeFi lending and storage service provider, Akropolis uses the Curve protocol for its storage, which was exploited in the attack earlier in the day. The attackers withdrew $50,000 in DAI from the project's yCurve and sUSD pools, stealing a total of $2 million worth of DAI before depleting those pools.

In this attack, the hacker used the re-entry attack to cooperate with dYdX flash loan to invade the storage pool. In the agreement, the asset storage pool can be said to be the focus of defense. As a project party, the security prevention and protection measures for the fund pool should be given the highest priority. In particular, regular comprehensive inspections and code upgrades are indispensable in order to cope with the ever-changing attack methods of hackers.

Finally, Chengdu Lianan strongly appeals that for project parties, safety audits and regular inspections should not be forgotten; for investors, safety alerts should always be kept in mind and investment risks should be paid attention to.