- DeFi protocol Convergence hacked, resulting in a $210,000 loss.
- Unknown hacker exploited a smart contract vulnerability.
- 58 million CVG tokens minted and sold, causing a massive price drop.
- Team admits to a code removal that led to the exploit.
- Convergence’s total value locked (TVL) drops from $5.79 million to $3.35 million.
Hacker Exploits Convergence Smart Contract Vulnerability
On the morning of August 1, 2024, the decentralized finance (DeFi) protocol Convergence became the latest victim of a significant hacking incident. An unknown hacker exploited a vulnerability in the project’s smart contract, minting approximately 58 million CVG tokens and subsequently selling them, resulting in a $210,000 loss.
Details of the Attack
According to specialists from PeckShield, the hacker took advantage of a bug in the CvxRewardDistributor contract, which failed to validate untrusted user input for claiming rewards. This flaw allowed the hacker to mint the new CVG tokens and exchange them for 60 WETH and around 15,900 crvFRAX, as verified by Etherscan.
Convergence Team’s Response
In an official statement, Convergence confirmed the exploit and detailed that, in addition to the 58 million CVG tokens intended for staking, the hacker also acquired “unclaimed rewards” worth $2,000 meant for Curve liquidity providers. They attributed the vulnerability to the removal of a crucial line of code during a recent optimization effort.
“During optimization, we had to remove a line of code that checked input data. We apologize to the community and investors and take full responsibility for what happened,” the team stated.
Impact on CVG Token and TVL
The security breach caused the native CVG token of the protocol to plummet by over 99%, reducing its market capitalization to just $57,000. As of the time of reporting, the token is trading at $0.0004, according to CoinMarketCap.
Moreover, the total value locked (TVL) in Convergence’s smart contracts saw a significant drop from $5.79 million to $3.35 million, as per DeFiLlama.
Broader Implications for the Crypto Industry
This incident is a stark reminder of the vulnerabilities inherent in DeFi protocols and the critical importance of robust smart contract security. In July 2024 alone, the cryptocurrency industry suffered losses amounting to $266 million due to hacking incidents, with the Convergence hack being a notable addition to this alarming trend.
As the DeFi space continues to grow, ensuring the security of smart contracts and the integrity of financial protocols remains paramount. The Convergence team’s swift acknowledgment and transparency are steps in the right direction, but this event underscores the need for continuous vigilance and improvement in the DeFi ecosystem.
