Slow fog: Drips Network lost approximately 24.9 million DAIs due to integer conversion holes

On 5 July, according to slow fog monitoring, Drips Network was attacked under the WCA agreement, resulting in the loss of approximately 249,000 DAIs. The slow-mog analysis revealed that the origin of the attack was the integer-type conversion defects of the Give (address, unit 128) function in the DaiDripsHub contract, which converted the sum of the uint128 type to the int128 type without verifying whether the reference exceeded the maximum value of int128. By entering specific values beyond the range of int128, the attackers turned the converted amount into a negative amount, which led to a reversal of the transfer direction, resulting in an abnormal withdrawal from the reserve contract to the aggressor ' s account, which eventually resulted in the depletion of the reserve funds。