CertiK: USPD contract attack resulted in a loss of approximately $1 million, with the entire attack lasting 2 months

According to ChainCatcher, CertiK Alert monitoring has detected that the USPD contract suffered an attack resulting in a loss of approximately $1 million. The attacker manipulated storage data to carry out the exploit, with the entire attack process lasting two months. Analysis shows the attack occurred in two stages: first, the attacker front-ran a legitimate initialization transaction to add a malicious intermediary proxy to the USPD stabilizer; then, the attacker used the malicious proxy to grant privileged roles to their contract, and 78 days later exploited these privileges to launch the attack.