MetaVaults - Bringing Curators to the Yield Tokenization Sector
At Spectra, we’ve spent the last years building the most complete permissionless ecosystems for yield tokenization. However, despite the growth, we’ve encountered real UX challenges - some stemming from the inherent nature of fixed-term markets, others resulting from our own design choices. This piece is about how MetaVaults aim to solve some of the toughest frictions we’ve faced. But before we get into what they unlock, it’s worth being honest about what hasn’t worked and how we’re approachi...
Spectra MetaVaults are Live
A Game-Changing Milestone for the Yield Tokenization Ecosystem
$SPECTRA: Migration is now live
The Spectra DAO concluded a SIP3 vote on December 16, 2024, to migrate APW to a new ticker, $SPECTRA, update tokenomics, and deploy its governance-related contracts on the Base Network. Perspective SAS (Spectra’s DevCo) deployed the necessary infrastructure and interface for existing APW and veAPW holders, allowing for a seamless migration to SPECTRA and veSPECTRA. Open the official migration page: https://app.spectra.finance/migrate-apw The official step-by-step tutorial for APW and veAPW ho...
<100 subscribers
MetaVaults - Bringing Curators to the Yield Tokenization Sector
At Spectra, we’ve spent the last years building the most complete permissionless ecosystems for yield tokenization. However, despite the growth, we’ve encountered real UX challenges - some stemming from the inherent nature of fixed-term markets, others resulting from our own design choices. This piece is about how MetaVaults aim to solve some of the toughest frictions we’ve faced. But before we get into what they unlock, it’s worth being honest about what hasn’t worked and how we’re approachi...
Spectra MetaVaults are Live
A Game-Changing Milestone for the Yield Tokenization Ecosystem
$SPECTRA: Migration is now live
The Spectra DAO concluded a SIP3 vote on December 16, 2024, to migrate APW to a new ticker, $SPECTRA, update tokenomics, and deploy its governance-related contracts on the Base Network. Perspective SAS (Spectra’s DevCo) deployed the necessary infrastructure and interface for existing APW and veAPW holders, allowing for a seamless migration to SPECTRA and veSPECTRA. Open the official migration page: https://app.spectra.finance/migrate-apw The official step-by-step tutorial for APW and veAPW ho...
Share Dialog
Share Dialog
On July 23, 2024, at approximately 3:00 PM UTC, an attack targeted Spectra's router contract.
The attacker managed to hijack user transactions, resulting in a loss of around 168 ETH. The attack occurred on Ethereum Mainnet, and our team’s swift reaction enabled us to limit the effects as a total of 4 wallets were impacted.
The core protocol contracts remain unaffected, and the funds inside them are safe.
The Spectra App (https://app.spectra.finance/) was reinstated in the morning CET hours on July 24th and is safe to use.
The incident resulted from the exploitation of a command in the routing utility contract. This command allowed Spectra users to enter and exit the pool with a token of their choice. After prompting users to leave the pool the attacker exploited the command in order to sweep funds once a user unknowingly approved the transaction on the router.
A suspicious Discord user, believed to be the attacker, started making false claims about issues with Spectra's YT token contracts to prompt users to withdraw funds. Those who attempted to withdraw were required to approve the transaction first, making them vulnerable to the attack.
Upon identifying the attack vector, our team promptly activated an incident response plan, disabling the Spectra App and terminating router contracts that enabled the attacker to hijack transactions.
As a precaution, Principal Token contracts were paused, preventing token exchanges at Curve's pool level (Spectra's primary AMM). The contracts were unpaused at approximately 9 PM UTC the very same day.
The attacker’s wallet where the stolen funds were transferred: https://etherscan.io/address/0x53635bf7b92b9512f6de0eb7450b26d5d1ad9a4c
Spectra's top priority is recovering affected users' funds. Authorities and relevant third parties, including leading exchanges and industry-leading security teams, have been contacted for their support and expertise in tracing and recovering funds.
We have also sent the hacker an on-chain message, offering to close the case if they return 90% of the stolen funds:
IDM: Hi. We are offering a 10% reward of the... | Success | Jul-23-2024 10:03:23 PM (UTC)
If you are an affected wallet holder, please complete the following form so we can contact you directly:
In an environment where it is technically impossible to foresee all potential sources of attacks, we are doing our utmost to guarantee the highest level of security through regular external audits of our contracts and the use of best practices. We continue collaborating with security experts to resolve this situation and provide community updates via Twitter and Discord as we progress.
If you have any information that would help resolve this case, please get in touch with the Spectra team via incidentresponse@spectra.finance
We appreciate everyone's support!
On July 23, 2024, at approximately 3:00 PM UTC, an attack targeted Spectra's router contract.
The attacker managed to hijack user transactions, resulting in a loss of around 168 ETH. The attack occurred on Ethereum Mainnet, and our team’s swift reaction enabled us to limit the effects as a total of 4 wallets were impacted.
The core protocol contracts remain unaffected, and the funds inside them are safe.
The Spectra App (https://app.spectra.finance/) was reinstated in the morning CET hours on July 24th and is safe to use.
The incident resulted from the exploitation of a command in the routing utility contract. This command allowed Spectra users to enter and exit the pool with a token of their choice. After prompting users to leave the pool the attacker exploited the command in order to sweep funds once a user unknowingly approved the transaction on the router.
A suspicious Discord user, believed to be the attacker, started making false claims about issues with Spectra's YT token contracts to prompt users to withdraw funds. Those who attempted to withdraw were required to approve the transaction first, making them vulnerable to the attack.
Upon identifying the attack vector, our team promptly activated an incident response plan, disabling the Spectra App and terminating router contracts that enabled the attacker to hijack transactions.
As a precaution, Principal Token contracts were paused, preventing token exchanges at Curve's pool level (Spectra's primary AMM). The contracts were unpaused at approximately 9 PM UTC the very same day.
The attacker’s wallet where the stolen funds were transferred: https://etherscan.io/address/0x53635bf7b92b9512f6de0eb7450b26d5d1ad9a4c
Spectra's top priority is recovering affected users' funds. Authorities and relevant third parties, including leading exchanges and industry-leading security teams, have been contacted for their support and expertise in tracing and recovering funds.
We have also sent the hacker an on-chain message, offering to close the case if they return 90% of the stolen funds:
IDM: Hi. We are offering a 10% reward of the... | Success | Jul-23-2024 10:03:23 PM (UTC)
If you are an affected wallet holder, please complete the following form so we can contact you directly:
In an environment where it is technically impossible to foresee all potential sources of attacks, we are doing our utmost to guarantee the highest level of security through regular external audits of our contracts and the use of best practices. We continue collaborating with security experts to resolve this situation and provide community updates via Twitter and Discord as we progress.
If you have any information that would help resolve this case, please get in touch with the Spectra team via incidentresponse@spectra.finance
We appreciate everyone's support!
No comments yet