Decurity retweetledi
⛑️ Defimon caught a live CPIMP-style backdoor on a production protocol, alerted the team, and the funds were locked down before the attacker could fire.
Previously the exploiters who front-run initialize() call set several known implementation slots automatically. After @etherscan added ">1 implementation" label, such attempts were easily exposed.
The exploiters are more stealthy now. They overwrite impl slot precisely, emit fake "Upgraded" events and even verify a copy of the real impl with their backdoor. In this case the backdoor was hidden inside what looks like a stock OpenZeppelin file: Initializable.sol.
The exploiter was definitely waiting for more funds to drain, so our timely alert helped to neutralize the threat before they could activate the backdoor.
English
