ParaSpace, a staking platform that deals in cryptocurrencies and NFTs, has launched a withdrawal time lock security feature following a recent security breach. The enhancement has been implemented to prevent flash loan attacks on its cross-margin lending protocol.
After a user withdraws funds, they will first enter the smart contract wallet, where a minimum value and a risk control value will be set for the withdrawal amount. This process will prevent upper-layer aggregators and liquidity pools from accessing the funds, and the underlying yield token logic will be destroyed.
However, ParaSpace noted that the new security measure may not have much impact on NFTfi, which is currently low-frequency, high-value, and less composable.
This move comes after ParaSpace experienced an attempted exploit that could have put $5 million at risk on March 17. While the project was able to prevent the attack and reported that all user funds, including NFTs, were safe, it did lose 50 to 150 ETH (less than $270,000) due to price slippage during the incident.
ParaSpace has promised to cover the protocol losses and has also agreed to provide a 5% bounty to BlockSec, the company that alerted them to the issue. ParaSpace has confirmed that it is currently patching the issue and has paused its protocol until further audits are conducted.
ParaSpace also revealed that despite undergoing nine previous audits from various companies, including some that occurred just months ago, the vulnerability still existed.
In addition to the withdrawal time lock security feature, ParaSpace has also imposed a new limitation that will see large withdrawals being time-locked. The exact time when the protocol will be reactivated remains unknown.
