CertiK: The USPD contract attack resulted in a loss of approximately $1 million, with the entire attack process lasting 2 months.

According to ChainCatcher, CertiK Alert monitoring reports that the USPD contract suffered an attack resulting in a loss of approximately $1 million. The attacker manipulated stored data to carry out the attack, which lasted for two months. Analysis indicates the attack occurred in two stages: first, the attacker preemptively executed a legitimate initialization transaction to add a malicious intermediary proxy to the USPD stabilizer; then, through the malicious proxy, the attacker granted privileged roles to their contract and exploited these privileges 78 days later to carry out the attack.