USPD Contract Suffers $1 Million Loss in Prolonged Attack

According to ChainCatcher, CertiK Alert has reported a security breach involving the USPD contract, resulting in a loss of approximately $1 million. The attack, which spanned two months, involved manipulation of stored data. Analysts have identified two phases in the attack: initially, the attacker executed a legitimate initialization transaction to insert a malicious intermediary proxy into the USPD stabilizer. Subsequently, the attacker used this proxy to grant privileged roles to their contract, exploiting these privileges 78 days later to carry out the attack.