Crypto and NFT staking platform ParaSpace experienced an exploit attempt that put $5 million at risk, according to various reports on March 17.
ParaSpace confirms vulnerability
ParaSpace acknowledged an attack on its contracts earlier today. He suspended his protocol and later said he had found the cause of the exploit.
The project further stated that all user funds including NFTs are safe. ParaSpace lost 50-150 ETH (less than $270,000) due to price slippage during the attack and recovery. ParaSpace said it would cover these protocol losses. Additionally, he said he would provide a 5% bounty to BlockSec, who informed him of the issue.
Asked about past audits, ParaSpace admitted the problem existed despite nine audits of multiple companies – some of which took place just a few months ago.
ParaSpace said it is correcting the issue and noted that the protocol break will remain until further audits. Although ParaSpace did not announce a reactivation timeframe, it added another limitation: large withdrawals will be time locked.
BlockSec intercepted the attacker
Crypto security company BlockSec first reported the attack against ParaSpace at 6:50 UTC on March 17. Around that time, he intercepted the hacker and saved 2,900 ETH ($5 million). The company attempted to contact ParaSpace but received no response.
According to BlockSec, a vulnerability in one of ParaSpace’s smart contracts allowed the attacker to borrow additional tokens through a six-step process.
BlockSec also disclosed in statements to The block that he used the hacker’s own exploit – even redeploying a version of the original attack contract – to forcibly recover the stolen funds. BlockSec held the recovered funds and returned them to ParaSpace.
The hacker later sent a message to BlockSec in a blockchain transaction that requested reimbursement of 0.7 ETH ($1,250) in gas fees. The striker wrote, “I lost a lot of money trying to make it work” and added, “It would be cool to get at least some (of that money) back.”
ParaSpace is a platform that allows users to stake other assets, including non-fungible tokens (NFTs) and ERC-20 tokens. Its site announces the staking of the Bored Ape Yacht Club (BAYC), although the two projects are not officially associated.