Alexintosh.eth raised a potential exploit concern last night on Twitter, alleging that approvals for contracts were impersonating wallet addresses and tricking users into approving the wrong wallet operations. Convex then prompted users to "review approvals" as developers looked into a "possible front end issue" shortly after. Convex identified five wallets as being vulnerable to the susceptibility. According to developers, funds on confirmed contracts on Convex were unaffected. Token approvals or rights users give to decentralized apps (dApps) to access tokens in their crypto wallets are the basis of how crypto wallets operate.
In a phishing assault, attackers may mimic a protocol's website's front end to trick users into approving the erroneous action, giving the attacker access to the wallet that has been compromised and enabling them to syphon tokens from that wallet. As alternatives for users, the creators setup "Convexfinance.fi" and "frax.convexfinance.fi." According to a tweet from the site's developers, users are advised to engage with the site using these URLs while the DNS hijack inquiry is ongoing.