SwapNet, m&#7897;t n&#7873;n t&#7843;ng t&#7893;ng h&#7907;p giao d&#7883;ch phi t&#7853;p trung (DEX) d&#7921;a tr&ecirc;n on-chain, v&#7915;a b&#7883; t&#7845;n c&ocirc;ng nghi&ecirc;m tr&#7885;ng v&agrave;o smart contract, khi&#7871;n g&#7847;n 16.8 tri&#7879;u USD t&agrave;i s&#7843;n ti&#7873;n m&atilde; ho&aacute; b&#7883; &#273;&aacute;nh c&#7855;p.
S&#7921; c&#7889; n&agrave;y ti&#7871;p t&#7909;c nh&#7845;n m&#7841;nh nh&#7919;ng r&#7911;i ro an ninh li&ecirc;n quan &#273;&#7871;n vi&#7879;c ph&ecirc; duy&#7879;t token v&agrave; c&aacute;c h&#7907;p &#273;&#7891;ng trung gian trong t&agrave;i ch&iacute;nh phi t&#7853;p trung (DeFi).
<h2 class="bic-gutenberg-heading wp-heading wp-block-heading" id="h-on-chain-dex-aggregator-swapnet-suffers-16-8-million-exploit">N&#7873;n t&#7843;ng t&#7893;ng h&#7907;p DEX on-chain SwapNet b&#7883; t&#7845;n c&ocirc;ng, thi&#7879;t h&#7841;i 16.8 tri&#7879;u USD</h2>

Theo PeckShield, k&#7867; t&#7845;n c&ocirc;ng &#273;&atilde; nh&#7855;m v&agrave;o c&aacute;c ho&#7841;t &#273;&#7897;ng li&ecirc;n quan &#273;&#7871;n SwapNet, c&oacute; th&#7875; truy c&#7853;p th&ocirc;ng qua Matcha Meta &ndash; n&#7873;n t&#7843;ng t&#7893;ng h&#7907;p DEX c&#7911;a &#273;&#7897;i ng&#361; 0x.
Tr&ecirc;n blockchain Base, k&#7867; t&#7845;n c&ocirc;ng &#273;&atilde; &#273;&#7893;i kho&#7843;ng 10.5 tri&#7879;u USD USDC l&#7845;y kho&#7843;ng 3,655 ETH, sau &#273;&oacute; <a href="https://beincrypto.com/learn/arbitrum-bridge" target="_blank" rel="noreferrer noopener">chuy&#7875;n t&agrave;i s&#7843;n n&agrave;y sang Ethereum</a>. &#272;&acirc;y l&agrave; chi&#7871;n thu&#7853;t ph&#7893; bi&#7871;n nh&#7857;m g&acirc;y kh&oacute; kh&#259;n cho vi&#7879;c truy v&#7871;t v&agrave; thu h&#7891;i t&agrave;i s&#7843;n.
Ph&iacute;a Matcha Meta gi&#7843;i th&iacute;ch r&#7857;ng s&#7921; c&#7889; n&agrave;y kh&ocirc;ng xu&#7845;t ph&aacute;t t&#7915; h&#7879; th&#7889;ng l&otilde;i c&#7911;a h&#7885;. Nh&#7919;ng ng&#432;&#7901;i d&ugrave;ng b&#7883; &#7843;nh h&#432;&#7903;ng ch&iacute;nh l&agrave; nh&#7919;ng ai &#273;&atilde; b&#7887; qua c&#417; ch&#7871; ph&ecirc; duy&#7879;t m&#7897;t l&#7847;n (One-Time Approval) c&#7911;a 0x &ndash; m&#7897;t t&iacute;nh n&#259;ng b&#7843;o m&#7853;t gi&uacute;p h&#7841;n ch&#7871; quy&#7873;n truy c&#7853;p token l&acirc;u d&agrave;i.
Khi v&ocirc; hi&#7879;u h&oacute;a t&iacute;nh n&#259;ng n&agrave;y, ng&#432;&#7901;i d&ugrave;ng &#273;&atilde; c&#7845;p quy&#7873;n cho c&aacute;c h&#7907;p &#273;&#7891;ng t&#7893;ng h&#7907;p, bao g&#7891;m c&#7843; router c&#7911;a SwapNet, t&#7841;o &#273;i&#7873;u ki&#7879;n cho k&#7867; t&#7845;n c&ocirc;ng x&acirc;m nh&#7853;p.
<blockquote class="max-w-xl text-4.5 border-l-2 border-blue-600 pl-11 mb-9 select-all [&amp;_p]:!mb-0 wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
&ldquo;Ch&uacute;ng t&ocirc;i &#273;&atilde; ghi nh&#7853;n m&#7897;t s&#7921; c&#7889; li&ecirc;n quan &#273;&#7871;n SwapNet m&agrave; ng&#432;&#7901;i d&ugrave;ng c&oacute; th&#7875; g&#7863;p ph&#7843;i tr&ecirc;n Matcha Meta &ndash; &#273;&#7863;c bi&#7879;t v&#7899;i nh&#7919;ng ai &#273;&atilde; t&#7855;t ch&#7913;c n&#259;ng One-Time Approvals,&rdquo; Matcha Meta <a href="https://x.com/matchametaxyz/status/2015542139791569260" target="_blank" rel="noreferrer noopener nofollow">th&ocirc;ng b&aacute;o</a> trong m&#7897;t tuy&ecirc;n b&#7889;.
</blockquote>

N&#7873;n t&#7843;ng n&agrave;y x&aacute;c nh&#7853;n &#273;ang ph&#7889;i h&#7907;p v&#7899;i &#273;&#7897;i ng&#361; c&#7911;a SwapNet, hi&#7879;n &#273;&atilde; t&#7841;m th&#7901;i v&ocirc; hi&#7879;u h&oacute;a c&aacute;c h&#7907;p &#273;&#7891;ng b&#7883; li&ecirc;n quan trong khi ti&#7871;p t&#7909;c &#273;i&#7873;u tra.
Matcha Meta c&#361;ng khuy&#7871;n c&aacute;o ng&#432;&#7901;i d&ugrave;ng n&ecirc;n nhanh ch&oacute;ng thu h&#7891;i c&aacute;c ph&ecirc; duy&#7879;t d&agrave;nh cho t&#7915;ng n&#7873;n t&#7843;ng t&#7893;ng h&#7907;p ngo&agrave;i h&#7879; th&#7889;ng One-Time Approval c&#7911;a 0x &#273;&#7875; ph&ograve;ng ng&#7915;a r&#7911;i ro.
N&#7873;n t&#7843;ng c&#361;ng nh&#7845;n m&#7841;nh h&#7907;p &#273;&#7891;ng router c&#7911;a SwapNet (0x616000e384Ef1C2B52f5f3A88D57a3B64F23757e) l&agrave; quy&#7873;n ph&ecirc; duy&#7879;t c&#7847;n &#273;&#432;&#7907;c thu h&#7891;i g&#7845;p. N&#7871;u kh&ocirc;ng, v&iacute; c&#7911;a ng&#432;&#7901;i d&ugrave;ng v&#7851;n c&oacute; th&#7875; g&#7863;p r&#7911;i ro ngay c&#7843; sau khi s&#7921; c&#7889; &#273;&atilde; &#273;&#432;&#7907;c ki&#7875;m so&aacute;t.
<h2 class="bic-gutenberg-heading wp-heading wp-block-heading" id="h-defi-s-security-trade-offs-convenience-vs-safety-amid-rising-smart-contract-exploits">Nh&#7919;ng &#273;&aacute;nh &#273;&#7893;i v&#7873; b&#7843;o m&#7853;t c&#7911;a DeFi: Ti&#7879;n l&#7907;i hay an to&agrave;n gi&#7919;a l&uacute;c ng&agrave;y c&agrave;ng nhi&#7873;u v&#7909; khai th&aacute;c l&#7895; h&#7893;ng smart contract</h2>

S&#7921; c&#7889; l&#7847;n n&agrave;y ti&#7871;p t&#7909;c cho th&#7845;y nh&#7919;ng &#273;&aacute;nh &#273;&#7893;i th&#432;&#7901;ng th&#7845;y gi&#7919;a t&iacute;nh ti&#7879;n l&#7907;i v&agrave; an to&agrave;n trong DeFi. H&#7879; th&#7889;ng ph&ecirc; duy&#7879;t m&#7897;t l&#7847;n (One-Time Approval) y&ecirc;u c&#7847;u nh&agrave; &#273;&#7847;u t&#432; nh&#7887; l&#7867; ph&ecirc; duy&#7879;t t&#7915;ng giao d&#7883;ch, gi&uacute;p gi&#7843;m nguy c&#417; b&#7883; t&#7845;n c&ocirc;ng. Tuy nhi&ecirc;n, &#273;i&#7873;u n&agrave;y l&#7841;i g&acirc;y b&#7845;t ti&#7879;n cho c&aacute;c trader giao d&#7883;ch th&#432;&#7901;ng xuy&ecirc;n.
N&#7871;u ch&#7885;n ph&ecirc; duy&#7879;t kh&ocirc;ng gi&#7899;i h&#7841;n, c&aacute;c smart contract s&#7869; &#273;&#432;&#7907;c quy&#7873;n truy c&#7853;p li&ecirc;n t&#7909;c v&agrave;o t&agrave;i s&#7843;n c&#7911;a ng&#432;&#7901;i d&ugrave;ng. &#272;i&#7873;u n&agrave;y tr&#7903; n&ecirc;n &#273;&#7863;c bi&#7879;t nguy hi&#7875;m n&#7871;u nh&#432; h&#7907;p &#273;&#7891;ng b&#7883; t&#7845;n c&ocirc;ng.
Cho &#273;&#7871;n nay, SwapNet v&#7851;n ch&#432;a c&ocirc;ng b&#7889; b&aacute;o c&aacute;o k&#7929; thu&#7853;t chi ti&#7871;t ho&#7863;c cho bi&#7871;t li&#7879;u c&oacute; b&#7891;i th&#432;&#7901;ng cho ng&#432;&#7901;i d&ugrave;ng b&#7883; &#7843;nh h&#432;&#7903;ng hay kh&ocirc;ng. &#272;i&#7873;u n&agrave;y khi&#7871;n nhi&#7873;u c&acirc;u h&#7887;i v&#7873; tr&aacute;ch nhi&#7879;m v&agrave; gi&#7843;i ph&aacute;p kh&#7855;c ph&#7909;c c&ograve;n b&#7887; ng&#7887;.
S&#7921; kh&ocirc;ng r&otilde; r&agrave;ng ngay l&#7853;p t&#7913;c t&#7915; &#273;&acirc;y s&#7869; l&agrave;m t&#259;ng s&#7921; ch&uacute; &yacute; v&agrave; ki&#7875;m tra &#273;&#7889;i v&#7899;i c&aacute;ch th&#7913;c ph&ecirc; duy&#7879;t c&#361;ng nh&#432; t&iacute;ch h&#7907;p gi&#7919;a c&aacute;c n&#7873;n t&#7843;ng t&#7893;ng h&#7907;p trong h&#7879; sinh th&aacute;i DeFi.
<h2 class="bic-gutenberg-heading wp-heading wp-block-heading" id="h-another-ethereum-exploit-highlights-risks-of-unverified-closed-source-contracts">M&#7897;t v&#7909; khai th&aacute;c Ethereum n&#7919;a cho th&#7845;y r&#7911;i ro c&#7911;a h&#7907;p &#273;&#7891;ng ch&#432;a x&aacute;c minh, &#273;&oacute;ng m&atilde; ngu&#7891;n</h2>

V&#7909; vi&#7879;c n&agrave;y di&#7877;n ra trong b&#7889;i c&#7843;nh ng&agrave;y c&agrave;ng nhi&#7873;u cu&#7897;c t&#7845;n c&ocirc;ng v&agrave;o smart contract v&agrave; c&aacute;c s&#7921; c&#7889; b&#7843;o m&#7853;t tr&ecirc;n th&#7883; tr&#432;&#7901;ng ti&#7873;n m&atilde; ho&aacute;.
C&#361;ng trong c&ugrave;ng ng&agrave;y, &#273;&#417;n v&#7883; ki&#7875;m tra b&#7843;o m&#7853;t Pashov &#273;&atilde; ph&aacute;t hi&#7879;n m&#7897;t v&#7909; t&#7845;n c&ocirc;ng kh&aacute;c tr&ecirc;n Ethereum mainnet v&#7899;i kho&#7843;ng 37 WBTC, tr&#7883; gi&aacute; h&#417;n 3.1 tri&#7879;u USD.
V&#7909; vi&#7879;c n&agrave;y li&ecirc;n quan &#273;&#7871;n m&#7897;t h&#7907;p &#273;&#7891;ng kh&ocirc;ng c&ocirc;ng khai m&atilde; ngu&#7891;n, kh&ocirc;ng &#273;&#432;&#7907;c x&aacute;c minh v&agrave; ch&#7881; v&#7915;a &#273;&#432;&#7907;c tri&#7875;n khai 41 ng&agrave;y tr&#432;&#7899;c &#273;&oacute;. H&#7907;p &#273;&#7891;ng n&agrave;y ch&#7881; c&ocirc;ng b&#7889; m&atilde; bytecode kh&oacute; &#273;&#7885;c v&#7899;i con ng&#432;&#7901;i, g&acirc;y kh&oacute; cho vi&#7879;c r&agrave; so&aacute;t c&#7911;a c&#7897;ng &#273;&#7891;ng.
Nh&#7919;ng s&#7921; c&#7889; n&agrave;y c&agrave;ng cho th&#7845;y DeFi l&agrave; m&#7843;nh &#273;&#7845;t m&agrave;u m&#7905; cho c&aacute;c hacker t&#7853;n d&#7909;ng, xu&#7845;t ph&aacute;t t&#7915; nh&#7919;ng &#273;i&#7875;m y&#7871;u nh&#432;:
<ul class="bic-gutenberg-list wp-list list-disc ">
<li>M&atilde; h&#7907;p &#273;&#7891;ng kh&ocirc;ng &#273;&#432;&#7907;c x&aacute;c minh</li>

<li>Quy&#7873;n ph&ecirc; duy&#7879;t duy tr&igrave; li&ecirc;n t&#7909;c</li>

<li>C&aacute;c l&#7899;p &#273;&#7883;nh tuy&#7871;n ph&#7913;c t&#7841;p</li>
</ul>

D&ugrave; &#273;&atilde; c&#7843;i thi&#7879;n an ninh v&agrave; tr&#7843;i qua nhi&#7873;u cu&#7897;c ki&#7875;m to&aacute;n, DeFi v&#7851;n &#273;&#7889;i m&#7863;t v&#7899;i c&aacute;c l&#7895; h&#7893;ng v&#7873; c&#7845;u tr&uacute;c. &#272;i&#7873;u n&agrave;y khi&#7871;n c&#7843; nh&agrave; ph&aacute;t tri&#7875;n v&agrave; nh&agrave; &#273;&#7847;u t&#432; nh&#7887; l&#7867; ph&#7843;i c&acirc;n nh&#7855;c gi&#7919;a tr&#7843;i nghi&#7879;m s&#7917; d&#7909;ng thu&#7853;n ti&#7879;n v&agrave; vi&#7879;c qu&#7843;n l&yacute; r&#7911;i ro.

Một nền tảng tổng hợp DEX on-chain vừa bị mất 17 triệu USD trong một cuộc tấn công hợp đồng thông minh lớn