Back to Blog

Copycats of the Popsicle Finance Attack

Code Auditing
August 9, 2021

Our system has observed a couple of transactions that have called “collectFees(0,0)” of the SorbettoFragola contract. Some of them are the copycats who want to launch the similar attack of (0xcd7dae143a4c0223349c16237ce4cd7696b1638d116a72755231ede872ab70fc). Fortunately, there are only limited number of tokens in the pool.

“2021–08–04T12:17:27Z” : [ “0xfdeb455027202aa1e82e0eef85075870db0fb4a2427e81bc3a01973024923c39” ],

“2021–08–07T07:33:36Z” : [ “0xdb5303b6e5aa0148bdd31fd5c51319243940755e956002b820033b1eba602ef6” ],

“2021–08–03T22:53:42Z” : [ “0xcd7dae143a4c0223349c16237ce4cd7696b1638d116a72755231ede872ab70fc” ],

“2021–07–21T22:06:24Z” : [ “0x631cdd776ceeb062a6c71ebddd7357a5d873182446382c03bd8abaf85deb69e4” ],

“2021–08–04T11:01:18Z” : [ “0xa4430da5cc039b84213b44e4ca6ade9750fab987fbab3da27a11bbd0c7d23ee6” ],

“2021–08–05T14:46:05Z” : [ “0xf7d36fff17b56d5396539c8573ffeb8abd4b67ee22f4a7c492f2bd0ddfba8272” ],

“2021–08–06T11:26:57Z” : [ “0xb25e3f872896a0fde22ce60b57553b5304aa4584c47bdb293589bdbd3317de65” ],

“2021–08–05T11:52:23Z” : [ “0x1af887449dac564272fa15a8d91012759e40c1356b6ffcd5c88d2ac50c8c8502” ],

“2021–08–04T10:22:49Z” : [ “0xe86742e4c6831c6a46278d9a0143adbc8885a6f56191c52045e775ee22f870b0” ],

“2021–08–02T05:36:13Z” : [ “0x2016024bcb3ab283f367dfb34fced088db170c3c6cd026aa9f5c968654fd0142” ],

“2021–07–31T01:56:50Z” : [ “0xf34d0039dc0b20174e77cec510d7a094a2e81b4161a2a537de95b1fd089ae6f9” ],

“2021–08–06T07:34:22Z” : [ “0x2810a6f9f158c4e463e165e0aee6fecb1e617295e2215e015ee03d7265bd1e5a” ],

“2021–08–04T08:39:46Z” : [ “0xcc5a321ac3897beae976bceeeb651fa62f9975df90dd6431e73a8416bdf723b9” ]

About BlockSec

BlockSec is a pioneering blockchain security company established in 2021 by a group of globally distinguished security experts. The company is committed to enhancing security and usability for the emerging Web3 world in order to facilitate its mass adoption. To this end, BlockSec provides smart contract and EVM chain security auditing services, the Phalcon platform for security development and blocking threats proactively, the MetaSleuth platform for fund tracking and investigation, and MetaSuites extension for web3 builders surfing efficiently in the crypto world.

To date, the company has served over 300 esteemed clients such as MetaMask, Uniswap Foundation, Compound, Forta, and PancakeSwap, and received tens of millions of US dollars in two rounds of financing from preeminent investors, including Matrix Partners, Vitalbridge Capital, and Fenbushi Capital.

Official website: https://blocksec.com/

Official Twitter account: https://twitter.com/BlockSecTeam

Sign up for the latest updates
~$9.4M Lost: Injective, Aquifer Exploits | BlockSec Weekly
Security Insights

~$9.4M Lost: Injective, Aquifer Exploits | BlockSec Weekly

During the past week (2026/08/31 - 2026/09/06), four security incidents caused approximately $9.4M in losses across Injective, Solana, Ethereum, and Flow EVM. The largest was the Injective exploit, where an insurance fund identifier collided with a binary options market identifier and the settlement path never compared their denominations, draining about $4.8M; Aquifer on Solana lost about $2.47M because its swap path invoked an unvalidated caller-supplied Token Program, and Notional Finance V1 on Ethereum lost about $1.73M to an unchecked `uint128` cast that valued a debt at zero. Ankr FLOW on Flow EVM closed out the week with about $410K drained through a staking entry point that skipped its pause guard and minted against a stale ratio.

From Incidents to Regulation: Why Crypto Institutions Need Blockchain Penetration Testing
Security Services

From Incidents to Regulation: Why Crypto Institutions Need Blockchain Penetration Testing

Exchanges, payment firms, custodians, and wallet providers now lose the most money beyond the smart contract—in signing, custody, keys, people, and supply chains. Code-level audit and transaction-level monitoring each leave a gap, and traditional penetration tests may miss crypto's signing and fund semantics. This article opens our blockchain penetration testing series with the two legs of the case for institutions in scope: where the risk actually comes from, and how NYDFS, DORA, VARA, SFC, and MAS treat adversarial testing across five jurisdictions.

What Is Blockchain Penetration Testing? Definitions and Boundaries
Security Services

What Is Blockchain Penetration Testing? Definitions and Boundaries

No widely accepted definition of blockchain penetration testing exists, and many proposed ones tangle it with audit, scanning, and bug bounty. This article sets out a working definition—an adversarial, hands-on assessment of a running system, under agreed scope and rules of engagement, that validates exploitable paths and control chains—and what web3 adds: a money-handling threat model whose defining composition gap is the off-chain-to-on-chain handoff. It then maps the five testable capabilities of that chain and routes nearby objectives to code audit, wallet security audit, web3 security testing, scanning, and bug bounty.

Best Security Auditor for Web3

Validate design, code, and business logic before launch. Aligned with the highest industry security standards.

BlockSec Audit