Real World Asset (RWA) liquidity firm Curio fell victim to a smart contract attack involving a critical security vulnerability related to voting power privileges, which allowed the attacker to steal $16 million in crypto assets. Curio alerted its community about the attack and emphasized that they were addressing the situation. The company revealed that a MakerDAO-based smart contract used within Curio was breached.
The $16 Million Hack Attack
The company assured its users that the attack only affected the Ethereum side and that all Polkadot and Curio Chain contracts remained secure. Web3 security firm Cyvers estimates the losses from the attack to be around $16 million. The security firm stated that the attack involved a permission access logic security vulnerability.
On March 25th, Curio released a post-mortem of the attack and a compensation plan for affected users. The report highlighted that the issue was a flaw in the access control of voting power privileges. This allowed the attacker to acquire a small number of Curio Governance (CGT) tokens, gain access to the project’s smart contract, and increase voting power.
With the elevated voting power, the attacker was able to execute a series of actions that allowed the unauthorized minting of 1 billion CGT.
Noteworthy Steps from the Curio Team
In the report, Curio stated that all funds affected by the attack would be refunded. The team announced the release of a new token called CGT 2.0. With the new token, the team promised to restore 100% of the funds for CGT holders. For liquidity providers, Curio said it would run a compensation fund program. The team explained that payments would be made in four stages, each lasting 90 days. While this step could mean full payment may take up to a year, the team shared the following statement regarding the matter:
“The compensation program will consist of four consecutive stages, each lasting 90 days. In each stage, 25% of the losses incurred by the second token in the liquidity pools will be compensated in USDC/USDT parity.”
The company also said it would reward white-hat hackers who could help recover the lost funds. The team announced that hackers could receive a reward equivalent to 10% of the funds recovered in the first stage of recovery.
