fuzzland

Security researcher Shou Chaofan stated that he just purchased about 6TB of Fable model invocation data from a leading Chinese model relay station, which included sensitive credentials such as SSH keys, VPN configurations, Alibaba Cloud keys, and GitLab tokens. He claimed that the keys in this batch of data were sufficient for him to access the servers or internal systems of 19 leading Chinese companies, as well as 7 Chinese and CIS government-related agencies, including Huawei, Xiaomi, NIO, and MiniMax.The model relay station is positioned between users and models like Claude, so requests and responses pass through it first, allowing it to see the complete plaintext. Once developers insert SSH Keys, API Keys, VPN configurations, etc., into the Agent context, if the relay station saves or even sells these records, the company's system keys will also leak out. This is not the first time Shou Chaofan has warned about the risks of relay stations. A paper he participated in tested 428 LLM relay stations in April and found that 9 actively injected malicious code, 17 actually used AWS test keys deliberately placed by researchers to call AWS, and 1 directly transferred ETH from the test wallet.Shou Chaofan is a co-founder of the blockchain security company Fuzzland and has long been engaged in vulnerability and supply chain security research. At the end of March, he also first discovered that the source map in the Claude Code 2.1.88 release package accidentally exposed about 500,000 lines of TypeScript source code.

ChainCatcher news, Fuzzland co-founder Chaofan Shou tweeted that the vulnerability in the lending protocol Morpho's frontend (Bundler3) has been fixed.

ChainCatcher message, Fuzzland co-founder Chaofan Shou posted on the X platform that the front-end component Bundler3 of the lending protocol Morpho has a security vulnerability, advising users to avoid interacting through the front end.Shou emphasized that only the "Multicall" function is affected, and the other functions are safe. If users need to withdraw funds, it is recommended to execute the Withdraw function directly through the contract. Currently, user funds themselves are not affected.

ChainCatcher news, Solana re-staking platform Solayer tweeted that it has acquired blockchain analytics company Fuzzland. The merged team will focus on Solayer infiniSVM (hardware-accelerated SVM chain for Solana scaling), optimizing Solana validators (to increase throughput and maximize returns for sSOL holders), as well as dynamic analysis, formal verification, and real-time protection of SVM.Fuzzland created the smart contract hybrid fuzzer Ityfuzz, which supports many Web3 security companies today.

ChainCatcher news, Fuzzland co-founder Chaofan Shou stated on the X platform: "Vestra DAO has just been hacked and the attack is still ongoing. A loss of $480,000 has been incurred, and more may follow. It is advised to withdraw staked assets and liquidity immediately."

ChainCatcher news, Fuzzland co-founder Chaofan Shou stated on social media that the decentralized trading platform Clipper was hacked due to an API vulnerability (such as private key leakage). Currently, losses exceed $500,000, with $6.5 million at risk. He urges users to withdraw their funds immediately.

ChainCatcher news, a member of the blockchain security company FuzzLand stated on the X platform that the team prevented over $6.5 million in assets on Sonne Finance from being further attacked by hackers with just $100.Specifically, the Optimism native lending protocol Sonne, based on Compound, has a common Compound V2 vulnerability where attackers can perform precision loss attacks when there are uninitialized new pools (soVELO). FuzzLand immediately detected the attack after the hacker's initial strike and found that the attacker held a soVELO position, which made it impossible for them to exploit it without liquidating the precision loss. FuzzLand then exchanged $100 for some VELO and added it to the soVELO pool, rendering the vulnerability no longer exploitable, thus protecting approximately $6.5 million of the remaining fund pool from being reused.Previous report mentioned that earlier today, the Sonne Finance protocol on the OP chain was attacked by a hacker using a flash loan, resulting in approximately $20 million in losses through multiple attacks.It is reported that FuzzLand is dedicated to automated auditing and on-chain real-time auditing, focusing on a model that reduces reliance on manual security audits through AI and fuzz testing + formal verification, and providing on-chain real-time firewalls for protocols or end users.

ChainCatcher news, blockchain security company FuzzLand announced the completion of a $3 million seed round financing, led by 1kx, with participation from HashKey Capital, SNZ, and Panga Capital. FuzzLand stated that this funding will help accelerate the development of automated solutions for smart contract analysis using dynamic analysis and distributed computing software.