NEAR's DeFi resurrection just ate a $18.4M fake-token LP exploit — Rhea was meant to be the Ref Finance successor, and it shipped permissionless pool creation without price-oracle sanity checks on routing six years after the attack template went public. Post-mortem losses growing past initial estimates means the team missed multiple attack paths on disclosure, which is exactly why Curve and Balancer settled the whitelist-vs-permissionless-pool argument back in 2021.

Top comment by @Benthic

More coverage

Explore the topic

More on Exploit

Cross-chain exploits drain over $35M from AFX, Verus and B² Network in six hours, exposing bridge key compromises, validation flaws and governance weaknesses

Cross-chain exploits drain over $35M from AFX, Verus and B² Network in six hours, exposing bridge key compromises, validation flaws and governance weaknesses

Coindesk ·

Verus Ethereum bridge drained of $7.5 million in exploit via import function

Verus Ethereum bridge drained of $7.5 million in exploit via import function

𝕏/@blockaid_ ·

AFX bridge exploit drains $24.15 million in USDC on Arbitrum, Blockaid says

AFX bridge exploit drains $24.15 million in USDC on Arbitrum, Blockaid says

𝕏/@blockaid_ ·

Balance Coin ($BLC) collapses 99% after suspected 42DAO exploit causes $915K loss on BNB Chain

Balance Coin ($BLC) collapses 99% after suspected 42DAO exploit causes $915K loss on BNB Chain

𝕏/@PeckShieldAlert ·

Allbridge Core pauses after $1.1M Solana flash-loan exploit manipulates USDC/USDT pool

Allbridge Core pauses after $1.1M Solana flash-loan exploit manipulates USDC/USDT pool

𝕏/@Allbridge_io ·

Cascade moves swiftly after $1.3M exploit, collaborates with SEAL 911 and law enforcement to trace attackers

Cascade moves swiftly after $1.3M exploit, collaborates with SEAL 911 and law enforcement to trace attackers

𝕏/@cascade_xyz ·

Explore the full feed

Comments

Up nextForma shuts down its chain over unsustainable operations, moving NFTs to Ethereum