An attacker compromised the Amps contract 12 hours ago, stealing ~$6,700 USDC from 112 Amps users. 

@phil and the Amps team fixed the issue and refunded users. @horsefacts and the Farcaster team have been assisting. Farcaster wallets are safe and unaffected.

Who was affected?

Users who gave Amps an allowance to withdraw USDC from their wallet to purchase likes and recasts were affected.

Users who simply used Amps to receive funds for likes and recasts are unaffected. Users who did not use Amps are unaffected.

What happened?

The Amps team will publish a detailed report soon.  In short, their contract had a vulnerability and the attacker was able to withdraw USDC that the users have given Amps permission to withdraw. 

Some users gave Amps the permission to withdraw all USDC from their wallet, and the attacker was able to withdraw all USDC. 

Are Farcaster wallets unsafe?

No, Farcaster wallets remain safe to use. The exploit is entirely within the Amps contract and only affects users who explicitly gave Amps the permission to access their USDC.

What should I do to be safe?

Never give permissions to withdraw unlimited funds (as a user) and never ask for these permissions (as a dev). It is safer to ask user to transfer in a fixed amount (e.g. 100 USDC), and top up as needed.

To avoid becoming a victim during incidents like these, here are some classic tips:

- Don’t give large or unlimited approvals to any app
- If you already did, make sure to revoke those approvals

As far as I know, the Farcaster wallet currently doesn’t support revoking approvals or connecting to sites like RevokeCash. So for now, the solution is to import your private key into wallets like MetaMask or Rabby. For example, in Rabby you can revoke approvals directly within the wallet

DeBank: nerd | Lens: nerrd | X: realnerrd

Also, if you have imported a private key or de seed phrase from the Farcaster wallet into any other wallet and use it in the web version, you can also use it to install extensions that will warn you about suspicious transactions, fraudulent sites or malware. As @nerrd.eth rightly noted, you can use Revoke Cash to withdraw approvals, and you can also install an extension from Revoke Cash or Pocket Universe. Remember, safety comes first.

Yes, I understand, I also withdraw all approvals at once using Rabby Wallet, but additional extensions will still not hurt, since Rabby does not always say that the site can be safe.

These features are already built into Rabby