Statistics show that the protocol’s total valued locked (TVL), dropped from more than $28 million to $579.701, and the stablecoin dropped from $1 to zero.
Cashio App Exploited with an InfiniteMint Glitch, Project Ecosystem Shudders
Cashio App, a Solana-based decentralized currency project, has been attacked by an “infinite bug” exploit that the team revealed on Wednesday. The Twitter account of the team wrote: “Please don’t mint any CASH.” “There is an infinite mint glitch. We are currently investigating the problem and believe that we have identified the root cause. Please withdraw your funds. We will publish a Post Mortem ASAP.” The Cashio Team requested people “Retweet for Visibility.”
Samczsun was a Paradigm research partner and wrote an unofficial post mortem. Samczsun tweeted, “Another Solana fake account exploit.” Based on a quick scan, this time [Cashio App] lost approximately $50M. How is this possible? The researcher noted that in order to mint new CASH you must deposit collateral.
Paradigm’s research partner continued, “This cross-program invoke (CPI), will transfer tokens to your account from the protocol’s account. However, this is only possible if both accounts have the same token type.” The token program will reject any transfer that is not allowed. Here, the protocol validates that the crate_collateral_tokens account hold the right type of token by comparing it with the collateral account. It also confirms that the collateral account has the same token type and the saber_swap.arrow accounts.
Samczsun’s post-mortem notes
The mint field on the account for the arrow was never validated.
Cashio App’s TVL Drains and Stablecoin Cash Plummets to Zero
Data shows Cashio App’s TVL dropped from $28.81million to the current $579.283 TVL. The TVL fell by a small amount on March 22, 2022. Cashio App also has a stablecoin, whose value is tied to the U.S. Dollar. Since the attack, its value has fallen from $1 to zero. Cashio dollar (CASH), now joins many stablecoins that have failed to hold the $1 peg over the years.
According to coingecko.com, the total amount of CASH available is 39,837 646, but it’s not known how many coins are currently in circulation. According to the CASH contract, there is a current supply of CASH of approximately 1,999,702,768 as of the time of writing. Additionally, the 4ofEvMG and 7K88AAb addresses hold approximately 1,142.189,082 CASH at the time of writing.
