🚨 Important Announcement from Predyx 🚨

Hey Predyx community – we’ve got some news to share.

Recently, we experienced an attack that targeted a security vulnerability in our system. Thanks to our quick response, we were able to mitigate the attack within minutes. However, this vulnerability remains exploitable, and each time we attempt to bring the platform back online, the attacker resumes targeting us.

🔒 Your funds and shares are safe.

Unfortunately, the attacker did manage to drain some liquidity from our markets.

To ensure the safety and integrity of Predyx, we’ll be temporarily shutting down for a few days while we work diligently to patch the vulnerability.

If the individual responsible for the attack happens to be reading this or is active on SN, we invite you to reach out to us directly.
💰 We’re offering a bounty for disclosing the exploit.

We appreciate your patience and understanding as we strengthen our defenses. We’ll keep you updated every step of the way.

– The Predyx Team

cc @Undisciplined @grayruby @ek @DarkStacker @TNStacker @Coinsreporter @BlokchainB

view all related items

41 sats \ 5 replies \ @ek 6 Jan

Sorry to hear that. Will you provide us with the details once it's fixed it so we can learn from your mistakes?

100 sats \ 4 replies \ @mega_dreamer OP 6 Jan

Thanks for the kind words, yes for sure we will provide the details. We've figured out the attack mechanism. Its a parallel/concurrent API attack on the sell orders api.

We do have a rate-limit user-id/IP on nginx for that sell api. But some how this attacker is able to bypass that rate-limit.

When we try perform the same attack, nginx protects it seq 1 10 | xargs -n1 -P10 curl --output - 'https://beta.predyx.com/api..., but some how this attacker is able to bypass that rate-limit.

So far for the mitigation. today we switched to Cloudflare WAF. Most probably tomorrow we will be bring up the Broadcom Layer7 API Gateway.

100 sats \ 3 replies \ @ek 6 Jan

We do have a rate-limit user-id/IP on nginx for that sell api. But some how this attacker is able to bypass that rate-limit.

Maybe they use multiple IPs?

But why do you need a rate limit in the first place? Are they able to sell the same shares multiple times?

0 sats \ 2 replies \ @mega_dreamer OP 6 Jan

Possibly multiple IPs. But we also have rate-limit per user-id to mitigate the multiple IPs.

Yes they are able to sell same shares multiple times. We use mongodb with transaction locking. Maybe we need to switch to a transactional db like MySQL or Postgres.