Official announcements from Velocore or changes in the CPMM pool contract code

Velocore Exploited on zksync and Linea Networks, Over $7 Million Lost

Jun 2, 2024, 07:30 AM

Velocore, a decentralized exchange, has been exploited on the zksync and Linea networks, resulting in a loss of over $7 million. The attacker transferred the stolen funds to Ethereum, swapped them into ETH, and then moved them to another address. The exploit was related to the CPMM pool contract calculation, which lacked permission verification. The attacker invoked the velocore__execute function (0xec378808) of the LP contract with a carefully constructed parameter. Velocore has identified the exploit mechanism and is setting up an on-chain negotiation process. The Telos mainnet remains unaffected. Velocore is preparing a post-mortem article and has offered a bounty to the hacker.