Ankr ankrFLOW 合约遭攻击,Flow 基金会将补足资金
Flow 区块链官方发布声明称,今日约 06:18 UTC,Ankr 的 ankrFLOW 流动性质押合约存在漏洞,攻击者创建了约 860 万无抵押的 ankrFLOW。这并非 Flow EVM 或 Flow 协议漏洞,不影响 Flow 代币经济学。
攻击者随后将 ankrFLOW 作为抵押品,在 MORE Markets 借贷协议上耗尽约 1550 万 WFLOW 储备,价值约 41 万美元,滑点后获利约 24.6 万美元。部分报道错误称影响约 930 万美元。Ankr 与 MORE Markets 已暂停相关合约,部分交易所预防性暂停 FLOW 充值。
Flow 基金会将与 Ankr 合作补足被盗 WFLOW 储备并重新平衡流动性池。Flow 网络正常运行,ankrFLOW 质押与 MORE Markets 借贷将暂停至 Ankr 部署修复升级。用户资金安全,无需采取行动。
Statement on the Ankr Liquid Staking exploit
At approximately 06:18 UTC this morning, a vulnerability in Ankr's ankrFLOW liquid staking contract allowed an attacker to create approximately 8.6 million ankrFLOW with no backing. This was NOT an exploit of Flow EVM or the Flow protocol and it does not affect Flow Tokenomics.
The attacker then used this ankrFLOW as collateral on the MORE Markets lending protocol to drain its WFLOW reserve, taking around 15.5 million WFLOW, worth approximately $410,000. After slippage, the attacker realized approximately $246,000. Some reports have incorrectly reported the impact at ~$9.3 million. We have asked the team that first published it for a formal correction.
No MORE Markets or ankrFLOW depositor has lost funds, and no FLOW holder is affected.
The underlying exploit was not a vulnerability in Flow EVM or MORE Markets. It was in an Ankr Solidity smart contract. At no point was the Flow network exploited or directly impacted.
Within hours, Ankr and MORE Markets both paused the affected contracts, containing the issue. Some exchange partners paused FLOW deposits as a precaution until the situation was fully understood. We have been in contact with those partners, and given the issue is contained and the network is operating normally, we have asked them to re-enable FLOW deposits and expect that shortly.
Liquidity in the ankrFLOW/WFLOW pool on Flow EVM was impacted, and rebalancing that pool is part of the remediation. Working together with Ankr, Flow Foundation will replace the funds drained from the MORE Markets WFLOW reserve and ensure the liquidity pools are rebalanced.
The Flow network is operating normally. AnkrFLOW staking and MORE Markets lending remain paused until Ankr deploys the contract upgrade that fixes the root cause. If you have funds in either, they are safe and will be retrievable once the protocols are unpaused. No action is needed from users, developers or partners.
Further updates will follow on this account today and tomorrow as needed.
Thank you to all of our partners and community members who acted fast to flag this issue to the relevant teams. Flow network and FLOW token are fully operational, without issue.