You've probably heard the news by now. The wLEO contract was exposed to a hack earlier today on Ethereum which led to a massive drain on the pool.
Fortunately, many users were quick to realize that these were false transactions and they removed liquidity from the pool as soon as they found out. This reduced the hackers ability to steal ETH from the pool.
Earlier today, we managed to shut down the contract and withdraw the remaining liquidity from the pool (about 114 ETH).
It will take us some time to snapshot the balances before the hack and figure out who had withdrawn liquidity vs. who was still in the pool at the time of the hack, but we will continually work on it and keep you posted on the distribution of this ETH back to LPs.
From what I keep hearing, this has happened to many other pools on Uniswap. The token issuing contract/address gets exposed and then someone takes advantage of it to mint infinite tokens and rug pull the Uniswap pool to steal the Ethereum.
What we know is that the hacker in question stole ETH from the pool by minting WLEO to himself and then swapping it into the market for ETH.
The ETH was then sent to Binance (Binance has been contacted but there may be nothing they can do since the hacker seems to have used non-kyc'd accounts to receive the ETH).
The hacker's ETH address: https://etherscan.io/address/0x8c9a02c89c96940e377052a9be0c7326f89a2495
The flaw doesn't appear to be from the wLEO oracle on Hive (meaning that they didn't push through a false conversion).
This narrows it down to just a few possibilities for how they exposed the wLEO contract. We'll release more details as we continue to investigate and narrow it down further.
What we don't know is how the hacker was able to expose the WLEO contract in order to do this. Several of us and community members are researching this to find out.
Is LEO Safe?
One of the top questions right now is about LEO. In short, yes - LEO is safe. This hack only impacts WLEO on Ethereum and hasn't exposed any flaws in the Hive operations of LEO / LeoFinance.
It's a similar situation to if WBTC got hacked. If WBTC is hacked, then Bitcoin itself isn't exposed. Only the WBTC on Ethereum which represents BTC held in contracts is exposed. This means that the hacker can ravage the price of WBTC but they cannot impact the supply of BTC on the Bitcoin blockchain.
Similar situation here to WLEO / LEO -- the hacker has impacted the price and supply of WLEO but cannot touch LEO itself since those WLEO's they minted cannot be unwrapped into LEO.
What About the Project?
LeoFinance is so much more than WLEO. WLEO has been 1 in a long line of developments for our project - 1 that helped us reach out into the broader world of crypto. By stepping out into that broader world, we attracted a lot of attention. Attention has its positives and negatives.
While we still don't know for sure where the attack came from, it does seem that it is most likely from Ethereum and not someone on Hive as there were other ways to exploit the system through Hive that they did not take advantage of.
Just as ETH recovered from the DAO incident and Bitcoin has recovered from the many attacks/exchange hacks, so too will LEO will recover from this hack.
The latest release of https://LeoFinance.io was slated to come out on Monday (tomorrow) to offer a whole set of new features including a refined onboarding process, Metamask logins/signups, WLEO operations, revamped wallet UI and LeoInfra plug-ins.
This temporary setback will cause a slight delay in the release of the new LeoFinance UI update. We're still aiming to release it this week, but will focus on fixing the issues with WLEO first along with sorting through the remaining LP balances.
What doesn't kill us, makes us stronger.
This is a bump in the road for LEO but our roadmap is still our roadmap. We'll continue developing and buidling for Hive and for LeoFinance.
Thank You to Everyone on Hive
Since the hack earlier today, so many people have reached out to show their support for LEO. Many are avid users of our platform and others are supporters, buidlers and community members from all around Hive.
To everyone who has reached out and offered a hand to help, thank you. It means a lot and your support is what makes getting through this so much easier. This is one of the darkest times for our project as we work on finding the flaw and rebuidling stronger than ever.
Hive is a battle-hardened community and we all bonded in blood as we fought in the trenches against Steemit/Tron. It will take time to heal, but we'll get through this and come out the other side better for it.
Posted Using LeoFinance Beta
Looks like smart contracts (e.g. wLEO) are still at infancy. Here is a story from medium:
Source: Hacking an Ethereum contract
But kudos to LeoFinance team and community to take the bold step for wrapping LEO on ETH. The worst case scenario is that the stolen 329 ETH or around $120K may never be recovered. However, total value of LeoFinance could be in millions with upcoming upgrades.
Hopefully, LeoFinance will come up with a good compensation plan for the members who were affected in UniSwap and take a heart in lesson from this hacking.
Hecker's final gateway ETH address is: https://etherscan.io/address/0xa305fab8bda7e1638235b054889b3217441dd645#comments
It is strange that this address is used for years for phishing and Binance has not tagged it while other exchanges has responded previously. Source: DragonEx Hacked — Users Crypto Transferred and Stolen
Posted Using LeoFinance Beta
I've written Solidity code before some number of years ago and didn't find it all that hard. The key is to keep things short and simple, and to do thorough testing on a testnet before deploying for real. Always do a fuzzing test on your code to make sure there's no unexpected behaviour when fed unexpected or invalid input.
Smart contracts are the one feature I wish Hive had on-chain, when used right they're an extremely powerful tool for trustless decentralisation. Sure their biggest use has been tokens, but they're general purpose and can be used for far more than that.
Rising transaction fees on Ethereum ended up driving me away from developing on it, it became unfeasible for any of my ideas to be implemented in a user friendly manner.
Right now I consider Monero to be the best cryptocurrency, it's got the best overall technical approach to things. I even wrote a post about Monero. I'd say Hive is second place to Monero, and only because it doesn't feature any privacy features for transactions like Monero does.
Something that could combine the features of Monero, Hive, and Ethereum would be the ultimate blockchain platform.
Have you looked at theta?
It is written in solidity, too.
I don't code, so any feedback will help.
I'm still surprised that hive people trust binance after what they did in steem ! I will never trust binance in my life !
And we need more people to buy leo on HE to prevent the price drop. And please don't vote cryptopie's posts.
Posted Using LeoFinance Beta
Lol
Posted Using LeoFinance Beta
He made his bed, it's time for him to face the consequences. We all have two downvotes per day to give out.
Posted Using LeoFinance Beta
LOL havent seen you this fired up about a spammer but I like it
One thing I hate is cheaters. Shitposting for years, milking the reward pool and disrespecting those who work hard? I can't tolerate such thing.
I was able to buy 20 leo, I figured that people would panic sell and I could get a good price, not sure if I did, but I'll check again in a few weeks. I still think Leo is one of the tokens that can and will and has moved.
not sure 50 counts, but it is more of a show of support :)
How come no upvoting on @cryotopie posts?
Did they do something they shouldn't? Just curious because I upvote most of their posts.
Check out what he said in the comments of this post and judge for yourself!
Posted Using LeoFinance Beta
chill bro, am asking no need to have a tone with me. What's with the exclamation mark at the end of your statement.
No one is allowed to ask questions anymore?
No 'tone' @akumagai, I actually use exclamation marks a lot - you can see that on my latest post for example!
This is a big jump!
I have no desire (or power lol) to block anyone's self-expression and besides, I provided you with information you were looking for (just didn't spell it out). You are free to do what you like, including being sensitive to what was never intended.
Posted Using LeoFinance Beta
Yeah, nah. I just don't like it when people use exclamation marks. Grammatically it actually means different things when you are answering things. If you were announcing something totally unrelated to someone asking questions then its a good way to show excitement. But if you use it as an answer to someone's question it means you are shouting them down. Hence my disliking exclamation marks to answers.
Just saying. But thanks anyway. I wanted it spelt because I looked there and they are getting downvoted for their posts because they accused the Leo project owner? Or is there something elses other than that? Like they are posting spam? or content that are not good enough for a said community page?
I want context because I upvote most of their posts, not because they do it for a particular community but because they state they have some sort of health complication and want to help out someone that can be helped with their condition.
But if they are lying about said condition and that is the reason people are stating not to upvote their posts, then I want to know that way I am informed on how I should continue my support to them.
Just to be clear, I do not accept your description of how exclamation marks ought to be used or interpreted. I accept that that is how YOU use them and that is fine by me. As a courtesy, I will not use them in this comment.
Regarding the 'context', what I know is that the user came out with that senseless comment about Khal and in the Discord chat there were many comments about how the user also spams, vote farms and takes advantage of well-intentioned folk (perhaps like yourself).
If you wish more detailed discussion on this, I suggest you post your concerns in the LEO Discord and see what folk say. I understand what you say about wanting to make an informed decision on this.
Posted Using LeoFinance Beta
I followed the link to Leo? Is it the comment he made about losing 500 Leo? It's been edited so can't really tell what happened.
Check out the other comments, someone posted a screen-shot of what he originally said.
Posted Using LeoFinance Beta
These things happen, LEO will recover. If anything it should be seen as a good sign because it means LEO is worthy enough for someone to spend time trying to exploit it.
Also, thanks for your upvote on my post yesterday.
@oldtimer,
Lol, yep I still wonder why people followed him.
!tan
@theguruasia ~ (My account got less RC, so came with a dev account)
Congratulations, @asimo You Successfully Trended The Post Shared By @oldtimer.
You Utilized 3/3 Daily Summon Bot Calls.
TAN Current Market Price : 0.200 HIVE
This community has gone through so much!
Everyone stay strong, and especially you khal! We need more builders and people with vision!
Posted Using LeoFinance Beta
This has easily been one of the hardest days of my life. Seeing something that we all worked so hard for get wrecked by one person with bad intent.
Having all of you around has made it easier to process all of this and move on. Thanks Dalz ❤️
Posted Using LeoFinance Beta
Hang in there, man. The whole community supports you and your continued efforts.
:)
Posted Using LeoFinance Beta
The much better days are coming....Cheer up!
Posted Using LeoFinance Beta
This will only strengthen the Leo community. Keep your head up :<)
Posted Using LeoFinance Beta
Thank you!! 🦁
Posted Using LeoFinance Beta
No issues with how all of this is progressing. It sucks that it happened and it will take some time to fully unravel but the LEO community is far too strong to let this destroy it.
We will see a lot of advancement going into the end of the year and this will, in hindsight, be a moment we laugh at.
Keep posting and commenting, lets make Leofinance very attractive for people who visit it from the outside.
Posted Using LeoFinance Beta
Make LEO great again!!
We are here to stay!!
Posted Using LeoFinance Beta
It is funny that we talked last night and I got into the pool and this happened! I want to say that I am supportive. Although I am late into the project, but I am highly supportive of anything hive, people who knows me know that very well. I don't care about profit or loss. I want to say, if there any support that is needed I am here to help.
I am sure you will work towards finding the problem and provide a solution. Again, I am supportive on whatever you come up with.
Posted Using LeoFinance Beta
LEO son sale keep stacking son! I don’t sell for any less than a $1 so don’t waste my time telling me leo is at this or that! Keep stacking and we’ll recover
Shake off some weak hands and let’s keep going!
Sorry to hear about this. It shakes the nerves a little, but it's good that you put out this update, thanks.
I appreciate LeoFinance's support on many of my posts on that platform. I make pennies on most of my posts, even after 3 years of full time effort, but the Leo tokens are a welcome boost.
One thing though, I can no longer unstake my tokens (Leo or others) in Hive-Engine. It takes my verification, but when I refresh, nothing has happened. Been like this for about a week. I can buy and sell, but not unstake.
thanks for the good work and the speedy reaction saving that ETH.
I was unfortunately away for the day and came back to an empty wallet...
I hope that with the ETH saved + what the community was able to pull out we are able to save 50% (ish) and not everything is a total loss
Leo community can somehow compensate the loss later by upvoting affected accounts.
Posted Using LeoFinance Beta
but not cryptopie, right?
Right!
Same here, although I caught part of the 'news' early on, I had other plans and decided to trust everything would work out eventually.
Never a dull day in crypto.
Posted Using LeoFinance Beta
LEO is holding its price on hive-engine because as a community we know that LEO has a great team behind it and will continue to maintain its good value!
Posted Using LeoFinance Beta
Now we hope no one gets access to hive-engine to do exactly the same? The lack of consequences and focus seem a bit alarming here.
How one could do "exactly the same" on hive-engine ??? I don't understand
Posted Using LeoFinance Beta
hive-engine could be hacked and someone could either steal all hive or in case there is extra protection just mint tokens and sell on the market. since it's centralized, there is no consensus to protect users
It frightens me what could happen if a posting key or an app with posting authority is compromised.
BUY THE FING DIP!
Posted Using LeoFinance Beta
I always love myself a good dip. I wish the reasoning was better, but I guess we can’t pick or choose how they happen. 🦁 thanks for keeping those hands strong
Posted Using LeoFinance Beta
Thank you for writing this @leofinance / @khaleelkazi and updating us all on what you know so far about what happened. This ...
... is very concerning. I hope the UniSwap tech team is able to provide some help in tracking down the root cause of this significant loss. Along with others who were part of the LP, we'll look forward to future posts on details covering whatever loss recovery options you and the LeoFinance team deem best.
Keep your spirits up, as I think your hard work has created a healthy, dedicated, and tough-minded community. "This too shall pass" ...
Posted Using LeoFinance Beta
I was in the DAO when this happened, it was actually a non-incident in the end. A hacker had diverted funds thru a vulnerability in the system, but he was only able to send to a "child account" which was designated for minors. These accounts had a 30 day w/d waiting period, so the community had time to discuss and implement a fork. So they just nullified the hack before the funds were removed from the system... but would you believe that some idiots in the "community" (DAO) were against the fork? I had a vote, and of course I voted for the fork. It was great $700 turned into $5500 in 10 months! Too bad I just did not stay in ETH for like another year, it would have been over $80k lol
I'ma think I will HODL LEO a bit longer. This bodes well for the tribe!!!
Posted Using LeoFinance Beta
Full support mate. Let us know if there is anything we can do to help.
Posted Using LeoFinance Beta
It's a testing time and this is just a phase which we'll relatively by pass. Many people of course panicked from this and the discord channel of Leofinance did well with educating people on what happened. I expected this post and I'm glad it's coming. Ot definitely believe on the future of Leo and where it's headed hopefully we can ID this hacker with time.
I put 5000 Leo and 2 with a small Eth - it turns out I have lost everything and no one will return it to me?
Yeah. Just found out. $380 gone for me :(
Posted Using LeoFinance Beta
UNI swap doesn't seem remotely safe and this seriously makes me think I should dump all Ku UNI too and get everything off it.
Posted Using LeoFinance Beta
nothing to do with uniswap. it's the incompetence on this particular smartcontract developer
Are you sure? Very sure?
Posted Using LeoFinance Beta
yes
We are hearing various things, please document your claims...
The SPEW Pool got very lucky, our admin got our LEO out of
UniSwap about 2 minutes before the unwrapping site closed.
Also heard that many other LP's were hit the same way and
lots of ETH siphoned off. If it is one contract dev, then it could
also be criminal, leaving a back door method of making counterfeit
w(tokens) to steal ETH from pools. More Info Please
I am going to purchase me some LEO right now!
Posted Using LeoFinance Beta
Good explanation.
I strongly believe LEO community will be more stronger than ever.
Reminder HIVE and LEO are long term game and we'll win together
This is 1st Platform there i feel so happy it has a lots of Members are active
Posted Using LeoFinance Beta
Battle tested blockchain, battle tested community, battle tested leo.
Posted using Dapplr
I am gobsmacked at how the community has reacted - mostly no pitchforks but rather on solidarity, support of the team and the community. Thats a testament to what has been built. All the best to @khaleelkazi and this difficult period you and your team is going through.
I just got back from a mostly offline day and damn, sorry to hear about the hack but from what I've seen as a relative noob to the Leo community, you are all SO supportive of each other and want the project to succeed so I know you will bounce back with aplomb!
Posted Using LeoFinance Beta
Thanks for all your work @khaleelkazi. I know you'd feel like shit right now, but you handled everything calmly and minimised the damage for those with money on the line and for the community as a whole. Cheers.
Posted Using LeoFinance Beta
Congratulations to @Leofinance. This happening at this very early stage of WLEO is good as it helps the community work harder to prevent such flaws when our LEO heads towards $37. LEO is the next ETH. Let's watch as things unfold. This singular action is bringing more attention to LEO than had been. Lets remember #steemhostiletakeover and the aftermath.
Posted Using LeoFinance Beta
The DIP is already nearly sold out ...
Posted Using LeoFinance Beta
Attention does have it's positives and negatives.
We have the press now, there is a chance here to use this momentum to show the strength and unity of LeoFinance and the Hive community. Best of luck and keep the faith.
Posted Using LeoFinance Beta
Hey man, we got your back and understand that this shit happens! I only had a thousand in the spew pool so I got off easy. I picked up a bunch more on the leo dex from week hands too! P.S. Give someone your phone ## so we know we can wake you up if needed! lol (it looked like nobody could get a hold of you on discord)
Posted Using LeoFinance Beta
It's exactly as you say, What doesn't kill us, makes us stronger and We will get out of this way stronger!! Leo holding strong on HE after the obvious early panic which means people trust that project and trust is fundamental. Stay strong and continue the great job you already do!
Posted Using LeoFinance Beta
Good luck with getting this mess sorted out. I have been pretty impressed by how most people have reacted to events - which is a pleasant change from the normal :)
We got this! Let's pull through. What doesn't kill makes us stronger
Posted Using LeoFinance Beta
Big projects need some setback in their initial days. So this incident proves that LEO is going to be a giant in the times to come. I take it as a good omen.
I firmly believe that Leofinance project will emerge way stronger than before out of this mess.
LEO is and will always remain a king!
Posted Using LeoFinance Beta
I have full faith in Leo.
Posted Using LeoFinance Beta
still made my $ balance look like crap LOL
maybe i'll buy some more ;)
Posted Using LeoFinance Beta
Strong teams get only stronger when attacked.
Posted Using LeoFinance Beta
Have the time you need to work. LEO will get stronger, I have no doubt.
The community will have one more opportunity to demonstrate that we are united. We will take LEO back to its path to the Moon.
Posted Using LeoFinance Beta
This is unfortunate to see
things turned out this way.
As a community we will rebound
and continue this route
we all started.
Live long #leofinance.
Posted Using LeoFinance Beta
It's really a tough and rough time for you and the team right now but we believe in LEO and what you do. Everything will be alright in the end. Thanks for this update. Cheers!
Posted Using LeoFinance Beta
Together, we are all stronger and will continue to grow as a solid and important community.
I'm sure you'll be able to sort this one out, and in a few months all this will just be another bump in the road. Hang in there! 🤟
I haven't invested in LEO or any alt for what it's worth. Starting to invest now, already made me spend a couple of hundred of HIVE. Good luck Khal! I am sure you guys got this.
Speaking with a few people yesterday, their main concern was the supply of the total LEO would be diluted because the "fake" leo would be dumped into circulation. But if this is the case and these newly minted wLEO can not be unwrapped, that issue gets answered which is very good! Although I must admit, I don't fully understand why the minted wLEO can not be unwrapped into LEO.
Agreed. If there's one thing HIVE has shown, it's we can set aside our differences in the face of adversity and work towards the same goal as a community!
Good Luck guys, return stronger! Shit Happens.
Posted Using LeoFinance Beta
Sad to see what the Leo community is going through. Which you a smooth recovery during this time. Leo have been building strong for quite sometime. All the #Hive is with you.
It is a damn shame what happened. I can imagine the stress and frustration with everyone wanting answers including yourself. You have a good thing going with a strong community, and soon this will be a story to tell. Not many can tell such crypto-classic story. All the best bro, keep up the greatness.
Good thing the hack happened. If it happened another 6 months later, the damage would have been much greater.
Posted Using LeoFinance Beta
i am inviting my Friends to USE this platform
LEOFINANCE is save and very easy......
Posted Using LeoFinance Beta
Congratulations @leofinance! You have completed the following achievement on the Hive blockchain and have been rewarded with new badge(s) :
You can view your badges on your board and compare yourself to others in the Ranking
If you no longer want to receive notifications, reply to this comment with the word
STOP