Astrid, the Ethereum liquidity re-pledge pool, posted on the X platform that its smart contract was attacked. Astrid has suspended the contract, taken a snapshot of all holders, and will provide full compensation.
Astrid has since released a statistical table of deposit user and liquidity provider compensation (excluding internal deposits from internal teams). Liquidity providers will be compensated in the form of staked ETH tokens. Astrid later updated and stated that it had compensated all users for their losses.
Analysis by trading browser Phalcon stated that Astrid was attacked due to a flaw in the withdrawal function. The parameters of the withdraw() function (i.e. token address and token amount) can be manipulated. The specific attack process is as follows:
1. Create 3 fake tokens: A, B and C.
2. Use fake token 1 to withdraw cash and receive stETH.
3. Use fake token 2 to withdraw money and receive rETH.
4. Use fake token 3 to withdraw cash and receive cbETH.
5. Convert stETH, rETH, cbETH to ETH.