Furucombo DeFi Hack - Revision history

Azoundria at 18:51, 2 May 2023

2023-05-02T18:51:57Z

← Older revision		Revision as of 12:51, 2 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/furucombodefihack.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/furucombodefihack.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Furucombo.jpg\|thumb\|Furucombo]]Only the most intelligent contract in the world would think it's a good idea to send the funds of every participant to a hacker in response to their request.		[[File:Furucombo.jpg\|thumb\|Furucombo]]Only the most intelligent contract in the world would think it's a good idea to send the funds of every participant to a hacker in response to their request.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="cointelegraph-471" /><ref name="cointelegraph-472" /><ref name="theblockcrypto-473" /><ref name="cryptobriefing-474" /><ref name="cryptobriefing-475" /><ref name="halborn-476" /><ref name="peckshieldblog-477" /><ref name="furucombotwitter-478" /><ref name="kalis-1097" /><ref name="slowmisthacked-678" /><ref name="openblocksecgithub-2342" /><ref name="furucombomedium-2353" /><ref name="slowmistmedium-2354" /><ref name="kurtmbarrytwitter-2355" /><ref name="originprotocolgithub-2356" /><ref name="blocksecteammedium-3714" /><ref name="peckshieldmedium-3717" /><ref name="allprojectsmedium-3718" />
	<ref name="cointelegraph-471" /><ref name="cointelegraph-472" /><ref name="theblockcrypto-473" /><ref name="cryptobriefing-474" /><ref name="cryptobriefing-475" /><ref name="halborn-476" /><ref name="peckshieldblog-477" /><ref name="furucombotwitter-478" /><ref name="kalis-1097" /><ref name="slowmisthacked-678" /><ref name="openblocksecgithub-2342" /><ref name="furucombomedium-2353" /><ref name="slowmistmedium-2354" /><ref name="kurtmbarrytwitter-2355" /><ref name="originprotocolgithub-2356" /><ref name="blocksecteammedium-3714" /><ref name="peckshieldmedium-3717" /><ref name="allprojectsmedium-3718" />

	== About Furucombo ==		== About Furucombo ==
Line 51:		Line 50:
	!Description		!Description
	\|-		\|-
	\|February 27th, 2021 ~~12:00:00 AM~~		\|February 27th, 2021
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 59:		Line 58:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 78:		Line 80:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Storing funds in a multi-signature wallet where the keys are held by different trained individuals would prevent a similar incident. It is doubtful that any trained person would believe a request was from Aave 2 without questioning, and even more doubtful if the request asked them to send all client funds of multiple clients to a particular address.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	Storing funds in a multi-signature wallet where the keys are held by different trained individuals would prevent a similar incident. It is doubtful that any trained person would believe a request was from Aave 2 without questioning, and even more doubtful if the request asked them to send all client funds of multiple clients to a particular address.

	== References ==		== References ==
	<references><ref name="cointelegraph-471">[https://cointelegraph.com/news/furucombo-to-issue-ioucombo-tokens-to-repay-victims-of-15m-attack Furucombo to issue iouCOMBO tokens to repay victims of $15M exploit] (May 11, 2021)</ref>		<references><ref name="cointelegraph-471">[https://cointelegraph.com/news/furucombo-to-issue-ioucombo-tokens-to-repay-victims-of-15m-attack Furucombo to issue iouCOMBO tokens to repay victims of $15M exploit] (May 12, 2021)</ref>

	<ref name="cointelegraph-472">[https://cointelegraph.com/news/transaction-batching-protocol-furucombo-suffers-14-million-evil-contract-hack Transaction batching protocol Furucombo suffers $14 million “evil contract” hack] (May 11, 2021)</ref>		<ref name="cointelegraph-472">[https://cointelegraph.com/news/transaction-batching-protocol-furucombo-suffers-14-million-evil-contract-hack Transaction batching protocol Furucombo suffers $14 million “evil contract” hack] (May 12, 2021)</ref>

	<ref name="theblockcrypto-473">[https://www.theblockcrypto.com/linked/96572/defi-building-block-service-furucombo-exploited-for-14m DeFi building block service Furucombo exploited for $14M] (May 11, 2021)</ref>		<ref name="theblockcrypto-473">[https://www.theblockcrypto.com/linked/96572/defi-building-block-service-furucombo-exploited-for-14m DeFi building block service Furucombo exploited for $14M] (May 12, 2021)</ref>

	<ref name="cryptobriefing-474">[https://cryptobriefing.com/defi-tx-bundler-furucombo-hacked-14-million/ DeFi Transaction Bundler Furucombo Hacked for $14 Million \| Crypto Briefing] (May 11, 2021)</ref>		<ref name="cryptobriefing-474">[https://cryptobriefing.com/defi-tx-bundler-furucombo-hacked-14-million/ DeFi Transaction Bundler Furucombo Hacked for $14 Million \| Crypto Briefing] (May 12, 2021)</ref>

	<ref name="cryptobriefing-475">[https://cryptobriefing.com/defi-money-lego-app-furucombo-lands-1-85m-investment-ahead-of-token-launch/ DeFi Money Lego App Furucombo Lands $1.85M Investment Ahead of Token Launch \| Crypto Briefing] (May 11, 2021)</ref>		<ref name="cryptobriefing-475">[https://cryptobriefing.com/defi-money-lego-app-furucombo-lands-1-85m-investment-ahead-of-token-launch/ DeFi Money Lego App Furucombo Lands $1.85M Investment Ahead of Token Launch \| Crypto Briefing] (May 12, 2021)</ref>

	<ref name="halborn-476">[https://halborn.com/explained-the-furucombo-evil-contract-hack-feb-2021/ Explained: The Furucombo Evil Contract Hack (Feb 2021) - Halborn] (May 11, 2021)</ref>		<ref name="halborn-476">[https://halborn.com/explained-the-furucombo-evil-contract-hack-feb-2021/ Explained: The Furucombo Evil Contract Hack (Feb 2021) - Halborn] (May 12, 2021)</ref>

	<ref name="peckshieldblog-477">[https://blog.peckshield.com/2021/02/27/Furucombo/ The Furucombo Incident Analysis: Cascading Trust] (May 11, 2021)</ref>		<ref name="peckshieldblog-477">[https://blog.peckshield.com/2021/02/27/Furucombo/ The Furucombo Incident Analysis: Cascading Trust] (May 12, 2021)</ref>

	<ref name="furucombotwitter-478">[https://twitter.com/furucombo/status/1368884580803960837 @furucombo Twitter] (May 11, 2021)</ref>		<ref name="furucombotwitter-478">[https://twitter.com/furucombo/status/1368884580803960837 @furucombo Twitter] (May 12, 2021)</ref>

	<ref name="kalis-1097">[https://kalis.me/unlimited-erc20-allowances/ Unlimited ERC20 allowances considered harmful] (Jun 4, 2021)</ref>		<ref name="kalis-1097">[https://kalis.me/unlimited-erc20-allowances/ Unlimited ERC20 allowances considered harmful] (Jun 5, 2021)</ref>

	<ref name="slowmisthacked-678">[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17, 2021)</ref>		<ref name="slowmisthacked-678">[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 18, 2021)</ref>

	<ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10, 2021)</ref>		<ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 11, 2021)</ref>

	<ref name="furucombomedium-2353">[https://medium.com/furucombo/furucombo-post-mortem-march-2021-ad19afd415e Furucombo Post Mortem March 2021] (Aug 10, 2021)</ref>		<ref name="furucombomedium-2353">[https://medium.com/furucombo/furucombo-post-mortem-march-2021-ad19afd415e Furucombo Post Mortem March 2021] (Aug 11, 2021)</ref>

	<ref name="slowmistmedium-2354">[https://slowmist.medium.com/slowmist-analysis-of-the-furucombo-hack-28c9ae558db9 Slowmist Analysis Of The Furucombo Hack] (Aug 10, 2021)</ref>		<ref name="slowmistmedium-2354">[https://slowmist.medium.com/slowmist-analysis-of-the-furucombo-hack-28c9ae558db9 Slowmist Analysis Of The Furucombo Hack] (Aug 11, 2021)</ref>

	<ref name="kurtmbarrytwitter-2355">[https://twitter.com/Kurt_M_Barry/status/1365876788757471234 @Kurt_M_Barry Twitter] (Aug 10, 2021)</ref>		<ref name="kurtmbarrytwitter-2355">[https://twitter.com/Kurt_M_Barry/status/1365876788757471234 @Kurt_M_Barry Twitter] (Aug 11, 2021)</ref>

	<ref name="originprotocolgithub-2356">[https://github.com/OriginProtocol/security/blob/master/incidents/2021-02-27-Furucombo.md security/2021-02-27-Furucombo.md at master · OriginProtocol/security · GitHub] (Aug 10, 2021)</ref>		<ref name="originprotocolgithub-2356">[https://github.com/OriginProtocol/security/blob/master/incidents/2021-02-27-Furucombo.md security/2021-02-27-Furucombo.md at master · OriginProtocol/security · GitHub] (Aug 11, 2021)</ref>

	<ref name="blocksecteammedium-3714">[https://blocksecteam.medium.com/unlimited-approval-in-erc20-convenience-or-security-1c8dce421ed7 Unlimited Approval In Erc20 Convenience Or Security] (Oct 11, 2021)</ref>		<ref name="blocksecteammedium-3714">[https://blocksecteam.medium.com/unlimited-approval-in-erc20-convenience-or-security-1c8dce421ed7 Unlimited Approval In Erc20 Convenience Or Security] (Oct 12, 2021)</ref>

	<ref name="peckshieldmedium-3717">[https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/peckshield.medium.com/the-furucombo-incident-analysis-cascading-trust-c90d22c7dda7 https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/peckshield.medium.com/the-furucombo-incident-analysis-cascading-trust-c90d22c7dda7] (Oct 11, 2021)</ref>		<ref name="peckshieldmedium-3717">[https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/peckshield.medium.com/the-furucombo-incident-analysis-cascading-trust-c90d22c7dda7 https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/peckshield.medium.com/the-furucombo-incident-analysis-cascading-trust-c90d22c7dda7] (Oct 12, 2021)</ref>

	<ref name="allprojectsmedium-3718">[https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/zhuanlan.zhihu.com/p/361012676 https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/zhuanlan.zhihu.com/p/361012676] (Oct 11, 2021)</ref></references>		<ref name="allprojectsmedium-3718">[https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/zhuanlan.zhihu.com/p/361012676 https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/zhuanlan.zhihu.com/p/361012676] (Oct 12, 2021)</ref></references>

Azoundria at 19:55, 17 February 2023

2023-02-17T19:55:09Z

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/furucombodefihack.php}} FurucomboOnly the most intelligent contract in the world would think it's a good idea to send the funds of every participant to a hacker in response to their request. This is a global/international case not involving a specific country. == About Furucombo == "Furucombo, a drag and drop tool for users to create DeFi transactions," "suffered a c..."

2023-01-25T20:46:02Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/furucombodefihack.php}} thumb|FurucomboOnly the most intelligent contract in the world would think it's a good idea to send the funds of every participant to a hacker in response to their request. This is a global/international case not involving a specific country. == About Furucombo == "Furucombo, a drag and drop tool for users to create DeFi transactions," "suffered a c..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/furucombodefihack.php}}

[[File:Furucombo.jpg|thumb|Furucombo]]Only the most intelligent contract in the world would think it's a good idea to send the funds of every participant to a hacker in response to their request.

This is a global/international case not involving a specific country.

== About Furucombo ==
"Furucombo, a drag and drop tool for users to create DeFi transactions," "suffered a contract exploit on Feb. 27." "Furucombo adopts a permissionless “drag-and-drop DeFi” feature allowing users to build a custom strategy for earning from different DeFi projects. Moreover, it aggregates various liquidity pools and DeFi functionalities." The "tool designed to help users “batch” transactions and interactions with multiple decentralized finance (DeFi) protocols at once, fell victim to the attack at roughly 4:45 pm UTC."

"The attacker us[ed] a fake contract to trick the protocol into thinking that their contract was a new version of Aave. In an official post-mortem on March 1, Furucombo said that the breach affected 22 users, resulting in a loss worth $15 million in 21 different assets. The stolen assets included major DeFi coins like Bao Finance (BAO), COMBO, Curve DAO (CRV), as well as popular stablecoins like Tether (USDT) and USD Coin (USDC), Furucombo told Cointelegraph." "The hacker [sent] funds to the mixer Tornado Cash to cover their tracks and withdraw funds."

"In these “evil contract” exploits, an attacker creates a contract that fools a protocol into believing it belongs there, giving them access to protocol funds." "In this case, the attacker ‘tricked’ the Furucombo protocol into thinking that their contract was a new ver[si]on of Aave. From there, instead of draining funds from the protocol as in previous evil contract exploits, the attacker instead leveraged the ability to transfer the funds of every user who had given the protocol token permissions." "After successfully tricking Furucombo into believing it was a new version of Aave, the evil contract was able to take advantage of poorly configured permissions in Furucombo user accounts. These users gave ERC20 token permissions to the Furucombo protocol, allowing it to perform transactions using those tokens without further approvals." "“Infinite permissions means you can wipe everyone who interacted with Furucombo,” said whitehat hacker and co-founder of DeFi Italy Emiliano Bonassi in a statement to Cointelegraph." "Unlike many DeFi hacks, where the protocol itself suffers the losses, this vulnerability enabled direct exploitation of user accounts to the tune of at least $14 million in cryptocurrency."

"Furucombo has reported the issue to law enforcement and has started cooperating with smart contract analytics service Certora to receive a full audit for the incident." "Following an internal call with affected users, Furucombo released a compensation plan, announcing that they will issue 5 million iouCOMBO tokens to the victims of the breach. Issued in the form of ERC-20 tokens, iouCOMBO tokens will represent the rights to claim Furucombo’s COMBO tokens in the recovery pool." "Furucombo’s hack is another reminder for DeFi users to seriously consider contract security and not use money in new protocols that they can’t afford to lose."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Furucombo DeFi Hack
!Date
!Event
!Description
|-
|February 27th, 2021 12:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Storing funds in a multi-signature wallet where the keys are held by different trained individuals would prevent a similar incident. It is doubtful that any trained person would believe a request was from Aave 2 without questioning, and even more doubtful if the request asked them to send all client funds of multiple clients to a particular address.

== References ==
[https://cointelegraph.com/news/furucombo-to-issue-ioucombo-tokens-to-repay-victims-of-15m-attack Furucombo to issue iouCOMBO tokens to repay victims of $15M exploit] (May 11)

[https://cointelegraph.com/news/transaction-batching-protocol-furucombo-suffers-14-million-evil-contract-hack Transaction batching protocol Furucombo suffers $14 million “evil contract” hack] (May 11)

[https://www.theblockcrypto.com/linked/96572/defi-building-block-service-furucombo-exploited-for-14m DeFi building block service Furucombo exploited for $14M] (May 11)

[https://cryptobriefing.com/defi-tx-bundler-furucombo-hacked-14-million/ DeFi Transaction Bundler Furucombo Hacked for $14 Million | Crypto Briefing] (May 11)

[https://cryptobriefing.com/defi-money-lego-app-furucombo-lands-1-85m-investment-ahead-of-token-launch/ DeFi Money Lego App Furucombo Lands $1.85M Investment Ahead of Token Launch | Crypto Briefing] (May 11)

[https://halborn.com/explained-the-furucombo-evil-contract-hack-feb-2021/ Explained: The Furucombo Evil Contract Hack (Feb 2021) - Halborn] (May 11)

[https://blog.peckshield.com/2021/02/27/Furucombo/ The Furucombo Incident Analysis: Cascading Trust] (May 11)

[https://twitter.com/furucombo/status/1368884580803960837 @furucombo Twitter] (May 11)

[https://kalis.me/unlimited-erc20-allowances/ Unlimited ERC20 allowances considered harmful] (Jun 4)

[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17)

[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10)

[https://medium.com/furucombo/furucombo-post-mortem-march-2021-ad19afd415e Furucombo Post Mortem March 2021] (Aug 10)

[https://slowmist.medium.com/slowmist-analysis-of-the-furucombo-hack-28c9ae558db9 Slowmist Analysis Of The Furucombo Hack] (Aug 10)

[https://twitter.com/Kurt_M_Barry/status/1365876788757471234 @Kurt_M_Barry Twitter] (Aug 10)

[https://github.com/OriginProtocol/security/blob/master/incidents/2021-02-27-Furucombo.md security/2021-02-27-Furucombo.md at master · OriginProtocol/security · GitHub] (Aug 10)

[https://blocksecteam.medium.com/unlimited-approval-in-erc20-convenience-or-security-1c8dce421ed7 Unlimited Approval In Erc20 Convenience Or Security] (Oct 11)

[https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/peckshield.medium.com/the-furucombo-incident-analysis-cascading-trust-c90d22c7dda7 https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/peckshield.medium.com/the-furucombo-incident-analysis-cascading-trust-c90d22c7dda7] (Oct 11)

[https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/zhuanlan.zhihu.com/p/361012676 https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/zhuanlan.zhihu.com/p/361012676] (Oct 11)

← Older revision		Revision as of 13:55, 17 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/furucombodefihack.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/furucombodefihack.php}}
			{{Unattributed Citations}}

	[[File:Furucombo.jpg\|thumb\|Furucombo]]Only the most intelligent contract in the world would think it's a good idea to send the funds of every participant to a hacker in response to their request.		[[File:Furucombo.jpg\|thumb\|Furucombo]]Only the most intelligent contract in the world would think it's a good idea to send the funds of every participant to a hacker in response to their request.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="cointelegraph-471" /><ref name="cointelegraph-472" /><ref name="theblockcrypto-473" /><ref name="cryptobriefing-474" /><ref name="cryptobriefing-475" /><ref name="halborn-476" /><ref name="peckshieldblog-477" /><ref name="furucombotwitter-478" /><ref name="kalis-1097" /><ref name="slowmisthacked-678" /><ref name="openblocksecgithub-2342" /><ref name="furucombomedium-2353" /><ref name="slowmistmedium-2354" /><ref name="kurtmbarrytwitter-2355" /><ref name="originprotocolgithub-2356" /><ref name="blocksecteammedium-3714" /><ref name="peckshieldmedium-3717" /><ref name="allprojectsmedium-3718" />

	== About Furucombo ==		== About Furucombo ==
Line 29:		Line 31:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 51:		Line 52:
	\|-		\|-
	\|February 27th, 2021 12:00:00 AM		\|February 27th, 2021 12:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 64:		Line 61:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $15,000,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 75:		Line 72:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 86:		Line 83:

	== References ==		== References ==
	[https://cointelegraph.com/news/furucombo-to-issue-ioucombo-tokens-to-repay-victims-of-15m-attack Furucombo to issue iouCOMBO tokens to repay victims of $15M exploit] (May 11)		<references><ref name="cointelegraph-471">[https://cointelegraph.com/news/furucombo-to-issue-ioucombo-tokens-to-repay-victims-of-15m-attack Furucombo to issue iouCOMBO tokens to repay victims of $15M exploit] (May 11, 2021)</ref>

	[https://cointelegraph.com/news/transaction-batching-protocol-furucombo-suffers-14-million-evil-contract-hack Transaction batching protocol Furucombo suffers $14 million “evil contract” hack] (May 11)		<ref name="cointelegraph-472">[https://cointelegraph.com/news/transaction-batching-protocol-furucombo-suffers-14-million-evil-contract-hack Transaction batching protocol Furucombo suffers $14 million “evil contract” hack] (May 11, 2021)</ref>

	[https://www.theblockcrypto.com/linked/96572/defi-building-block-service-furucombo-exploited-for-14m DeFi building block service Furucombo exploited for $14M] (May 11)		<ref name="theblockcrypto-473">[https://www.theblockcrypto.com/linked/96572/defi-building-block-service-furucombo-exploited-for-14m DeFi building block service Furucombo exploited for $14M] (May 11, 2021)</ref>

	[https://cryptobriefing.com/defi-tx-bundler-furucombo-hacked-14-million/ DeFi Transaction Bundler Furucombo Hacked for $14 Million \| Crypto Briefing] (May 11)		<ref name="cryptobriefing-474">[https://cryptobriefing.com/defi-tx-bundler-furucombo-hacked-14-million/ DeFi Transaction Bundler Furucombo Hacked for $14 Million \| Crypto Briefing] (May 11, 2021)</ref>

	[https://cryptobriefing.com/defi-money-lego-app-furucombo-lands-1-85m-investment-ahead-of-token-launch/ DeFi Money Lego App Furucombo Lands $1.85M Investment Ahead of Token Launch \| Crypto Briefing] (May 11)		<ref name="cryptobriefing-475">[https://cryptobriefing.com/defi-money-lego-app-furucombo-lands-1-85m-investment-ahead-of-token-launch/ DeFi Money Lego App Furucombo Lands $1.85M Investment Ahead of Token Launch \| Crypto Briefing] (May 11, 2021)</ref>

	[https://halborn.com/explained-the-furucombo-evil-contract-hack-feb-2021/ Explained: The Furucombo Evil Contract Hack (Feb 2021) - Halborn] (May 11)		<ref name="halborn-476">[https://halborn.com/explained-the-furucombo-evil-contract-hack-feb-2021/ Explained: The Furucombo Evil Contract Hack (Feb 2021) - Halborn] (May 11, 2021)</ref>

	[https://blog.peckshield.com/2021/02/27/Furucombo/ The Furucombo Incident Analysis: Cascading Trust] (May 11)		<ref name="peckshieldblog-477">[https://blog.peckshield.com/2021/02/27/Furucombo/ The Furucombo Incident Analysis: Cascading Trust] (May 11, 2021)</ref>

	[https://twitter.com/furucombo/status/1368884580803960837 @furucombo Twitter] (May 11)		<ref name="furucombotwitter-478">[https://twitter.com/furucombo/status/1368884580803960837 @furucombo Twitter] (May 11, 2021)</ref>

	[https://kalis.me/unlimited-erc20-allowances/ Unlimited ERC20 allowances considered harmful] (Jun 4)		<ref name="kalis-1097">[https://kalis.me/unlimited-erc20-allowances/ Unlimited ERC20 allowances considered harmful] (Jun 4, 2021)</ref>

	[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17)		<ref name="slowmisthacked-678">[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17, 2021)</ref>

	[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10)		<ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10, 2021)</ref>

	[https://medium.com/furucombo/furucombo-post-mortem-march-2021-ad19afd415e Furucombo Post Mortem March 2021] (Aug 10)		<ref name="furucombomedium-2353">[https://medium.com/furucombo/furucombo-post-mortem-march-2021-ad19afd415e Furucombo Post Mortem March 2021] (Aug 10, 2021)</ref>

	[https://slowmist.medium.com/slowmist-analysis-of-the-furucombo-hack-28c9ae558db9 Slowmist Analysis Of The Furucombo Hack] (Aug 10)		<ref name="slowmistmedium-2354">[https://slowmist.medium.com/slowmist-analysis-of-the-furucombo-hack-28c9ae558db9 Slowmist Analysis Of The Furucombo Hack] (Aug 10, 2021)</ref>

	[https://twitter.com/Kurt_M_Barry/status/1365876788757471234 @Kurt_M_Barry Twitter] (Aug 10)		<ref name="kurtmbarrytwitter-2355">[https://twitter.com/Kurt_M_Barry/status/1365876788757471234 @Kurt_M_Barry Twitter] (Aug 10, 2021)</ref>

	[https://github.com/OriginProtocol/security/blob/master/incidents/2021-02-27-Furucombo.md security/2021-02-27-Furucombo.md at master · OriginProtocol/security · GitHub] (Aug 10)		<ref name="originprotocolgithub-2356">[https://github.com/OriginProtocol/security/blob/master/incidents/2021-02-27-Furucombo.md security/2021-02-27-Furucombo.md at master · OriginProtocol/security · GitHub] (Aug 10, 2021)</ref>

	[https://blocksecteam.medium.com/unlimited-approval-in-erc20-convenience-or-security-1c8dce421ed7 Unlimited Approval In Erc20 Convenience Or Security] (Oct 11)		<ref name="blocksecteammedium-3714">[https://blocksecteam.medium.com/unlimited-approval-in-erc20-convenience-or-security-1c8dce421ed7 Unlimited Approval In Erc20 Convenience Or Security] (Oct 11, 2021)</ref>

	[https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/peckshield.medium.com/the-furucombo-incident-analysis-cascading-trust-c90d22c7dda7 https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/peckshield.medium.com/the-furucombo-incident-analysis-cascading-trust-c90d22c7dda7] (Oct 11)		<ref name="peckshieldmedium-3717">[https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/peckshield.medium.com/the-furucombo-incident-analysis-cascading-trust-c90d22c7dda7 https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/peckshield.medium.com/the-furucombo-incident-analysis-cascading-trust-c90d22c7dda7] (Oct 11, 2021)</ref>

	[https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/zhuanlan.zhihu.com/p/361012676 https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/zhuanlan.zhihu.com/p/361012676] (Oct 11)		<ref name="allprojectsmedium-3718">[https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/zhuanlan.zhihu.com/p/361012676 https://medium.com/all_projects/ethscope/Approval/defcon/-/blob/master/zhuanlan.zhihu.com/p/361012676] (Oct 11, 2021)</ref></references>