The series of exploiting security and fraud vulnerabilities continues in decentralized finance, which is one of the newly emerging fields.

Most of the losses and frauds affecting decentralized finance, most of which were covered on the Arab Bitcoin website, were led by sophisticated hackers who understand very well the details of the work of decentralized protocols, which makes them search for the smallest details to find a loophole that enables them to seize cryptocurrencies.

Recently, $300,000 of Ethereum was lost after exploiting the Uniswap protocol and ERC 777 token.

What is Uniswap?

Uniswap is a decentralized protocol built on the Ethereum blockchain that facilitates the exchange of Ethereum and tokens across liquidity pools.

Read:Sirin Labs founder sued over debt default

More details about this protocol can be done through the link.

Instead of an order book, which has been several allegations of tampering, the protocol promotes a liquidity pool where participants earn money in exchange for any amount of money being made available for liquidity.

By providing an equal amount of ETH and ERC-20 tokens, anyone can create a liquidity pool, providing the perfect exchange rate for the swap.

Exploit the imBTC pool:

The hacker targeted imBTC token, a rolled-up version of bitcoin created by imtoken in partnership with Tokelon, a decentralized cryptocurrency exchange, and the token is available at UniSwap.

Today, the imBTC pool on Uniswap has been attacked and dried up. The hacker used an attack vector on ERC777 tokens on Uniswap.

BTC is not affected in the hold.

We have paused imBTC transfers at the moment, are assessing the situation and will inform you when transfers are restored

– tokenlon April 18, 2020

Tokelon acknowledged the attack and informed the community that funds in the imBTC liquidity pool were drained after the hacker used an attack vector on ERC-777 standard-based tokens on UniSwap.

Read:Is bitcoin a scam?

The good news is that the bitcoin holding is not affected but imBTC transfers are paused as Tokelon assesses the situation.

(9/12) There are a lot of other cool features (data fields, operators), but let’s skip the security issues.

– David Mihal (@dmihal) April 18, 2020

What is the ERC 777 standard?

The ERC 777 standard is similar to the popular ERC 20 standard, as both coexist on the Ethereum blockchain but the tokens ERC 777 Carrying a different feature to serve different needs, the standard was developed by Jordi Baillina, Jacoa Daflon and Thomas Chappabe.

The ERC 777 token seeks to improve some inefficiencies in the ERC-20 standard, which is popular for its simplicity but underperforms.

The ERC 777 token is backward compatible with ERC 20 and adds “hooks” that add advanced functionality in transfers and transfers.

There are no payability functions in ERC 20 tokens which means that if one wants to exchange ETH for DAI, for example, one has to initiate a transaction to agree to an infinite amount of DAI and another transaction to exchange it for ETH.

Read:Can Donald Trump Ban Bitcoin?

This is because in the ERC 20 standard the token will only be executed when it receives ETH, not other tokens.

The attackers exploited “hooks” and stole $300,000 of Ethereum because “hooks” are enabled in the ERC 777 standard, as there is no need for dual transactions that facilitate the free flow of funds between different dapps.

Re-entry attacks are not new because they were exploited by a DAO attacker, but this time the same exploit is possible with ERC 777 tokens.

The attacker used ERC 777 to steal $300,000 of ETH because before this attack, the Uniswap V1 version did not support these tokens, but after the recent upgrade to V2, ERC 777 support was introduced, it didn’t take long for the attacker to discover the vulnerability and take advantage of it to steal .

Read also:

Hacking a decentralized trading platform and stealing 250 thousand dollars

Over $420 Million Ethereum Locked In DeFi… What About Tron?