Liquidity provider Curio found itself embroiled in a significant security breach as a hacker exploited a vulnerability in its smart contract, resulting in the illicit minting of 1 billion tokens worth $16 million. The incident has prompted Curio to embark on a lengthy compensation program for affected users.
Exploit Details and Response
Curio disclosed that the breach stemmed from a critical flaw in its voting power privilege system within the MakerDAO-based smart contract. This vulnerability allowed the attacker to escalate their voting power, enabling them to execute unauthorized actions within the Curio DAO contract and mint the illicit tokens.
In response to the breach, Curio swiftly informed its community and assured them that only the Ethereum side of operations was compromised, with Polkadot and Curio Chain contracts remaining secure.
Source: Cyvers Alerts
Compensation Plan Unveiled
Following the post-mortem assessment of the exploit, Curio outlined a comprehensive compensation plan. The company pledged to reimburse all affected funds, introducing a new token, CGT 2.0, to restore 100% of lost funds for CGT holders.
For liquidity providers, Curio announced a four-stage compensation program, each lasting 90 days, with payments made in USDC/USDT equivalent to 25% of losses incurred by the second token in liquidity pools. This phased approach indicates that full reimbursement may take up to a year.
Acknowledgment of Assistance
Curio also extended gratitude to white hat hackers willing to assist in fund recovery efforts. Hackers contributing to the initial recovery phase may receive rewards equivalent to 10% of the recovered funds.
The exploit and subsequent response highlight the ongoing challenges facing decentralized finance platforms in ensuring robust security measures. Curio’s commitment to compensating affected users and engaging with the broader cybersecurity community underscores the importance of transparency and collaboration in safeguarding digital assets within the burgeoning DeFi landscape.
