{"id":183,"date":"2021-03-12T19:41:42","date_gmt":"2021-03-12T19:41:42","guid":{"rendered":"https:\/\/tradersofcrypto.com\/news\/?p=183"},"modified":"2021-03-12T19:41:42","modified_gmt":"2021-03-12T19:41:42","slug":"buyer-beware-top-recent-defi-exploits-and-hacks","status":"publish","type":"post","link":"https:\/\/tradersofcrypto.com\/news\/buyer-beware-top-recent-defi-exploits-and-hacks\/","title":{"rendered":"Buyer Beware: Top Recent DeFi Exploits and Hacks"},"content":{"rendered":"#\n<p><a href=\"\/guides\/crypto-jargon-explained\/\">DeFi<\/a> is built for frictionless investments and direct, easy decisions. There are widely known risks, such as immediate impermanent loss. However, one of the biggest <a href=\"\/guides\/top-crypto-investing-mistakes-to-avoid\/\">risks <\/a>in decentralized finance startups is an exploit of the underlying technology, which siphons off funds from investment pools. In the past couple of weeks, four high-profile projects erased more than $50M in value, potentially compromising their tokens\u2019 reputation.<\/p>\n\n\n\n<p>Compromised projects manage to survive, but there is no guarantee a complete loss of funds may not happen in any protocol. Over the past week, several high-profile exploits happened, pointing to ongoing weaknesses in decentralized investment.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Dodo Exchange Pool Exploits<\/strong><\/h3>\n\n\n\n<p>The Dodo Exchange hosts a series of pools similar to Uniswap. As with other similar exchanges, the liquidity protocol is automated by smart contracts, and pricing depends on the availability of tokens and ETH deposited by traders.&nbsp;<\/p>\n\n\n\n<p>The nature of Dodo\u2019s hack was contained in a smart contract function which could be called by an outside user. This helped the hacker mint fake WCRES tokens, then run the smart contract to drain its remaining liquidity.&nbsp;<\/p>\n\n\n\n<p>Several other tokens were attacked, including WSZO, ETHA and FUSI. The total loss from the Dodo exploit is estimated at the equivalent of $3.5M.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">PSA Regarding Recent Exploit on DODO<br><br>On March 8, Several DODO V2 Crowdpools were attacked. WSZO, WCRES, ETHA, and FUSI pools were impacted, while AC pool funds have been fully recovered. <br><br>Funds in all other pools, including all V1 pools and all non-Crowdpool V2 pools, are safe.<\/p>&mdash; DODO DEX (@BreederDodo) <a href=\"https:\/\/twitter.com\/BreederDodo\/status\/1369098897008648192?ref_src=twsrc%5Etfw\">March 9, 2021<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>The Dodo Exchange fell prey to a general problem in crypto space. Most smart contracts deployed are not audited, and deployed before a check whether their functions could affect the token supply.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Meerkat Finance<\/strong><\/h3>\n\n\n\n<p>Meerkat Finance was a new liquidity mining protocol built on top of Binance Chain. The attack was bigger than that of Dodo, taking away assets worth $31M. The exploit affected BUSD and BNB, without affecting other mechanisms on Binance Chain or the Binance exchange.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">About 8 hrs later The <a href=\"https:\/\/twitter.com\/search?q=%24BSC&amp;src=ctag&amp;ref_src=twsrc%5Etfw\">$BSC<\/a> exploit by MeerKat Finance transferred out over 70k <a href=\"https:\/\/twitter.com\/search?q=%24BNB&amp;src=ctag&amp;ref_src=twsrc%5Etfw\">$BNB<\/a> <br>I could be reading too much into this, but definitely possible something going on here possibly related \ud83d\ude42 <a href=\"https:\/\/t.co\/NHMiK4C4Ig\">https:\/\/t.co\/NHMiK4C4Ig<\/a> <a href=\"https:\/\/t.co\/wYatyJV9vB\">pic.twitter.com\/wYatyJV9vB<\/a><\/p>&mdash; cyrii_MM \u4e2d\u56fd\u62c9\u76d8 (@cyrii_MM) <a href=\"https:\/\/twitter.com\/cyrii_MM\/status\/1367510144305758208?ref_src=twsrc%5Etfw\">March 4, 2021<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>The exploit once again hinged entirely on the smart contract controlling the pair liquidity for automated trading. But red flags were raised by the fact that the event happened just a day after the protocol was deployed.&nbsp;<\/p>\n\n\n\n<p>Additionally, blockchain analysis showed tracks that suggested one of the admin accounts accessed the smart contract. This, plus the fact that Meerkat scrubbed its social media presence immediately, suggests the project most likely performed an exit scam.<\/p>\n\n\n\n<p>But the final message from the team may erase this theory. A Meerkat developer recently contacted the community of investors on Telegram, stating that the exploit was just a test and the funds would be recovered and returned to their rightful owners.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Furucombo<\/strong><\/h3>\n\n\n\n<p>Furucombo was another DeFi related protocol, which relied on automated batching of transactions. The service was available for investors that wanted to communicate with multiple liquidity pools, but wanted to avoid the mining fees.&nbsp;<\/p>\n\n\n\n<p>The total loss for the protocol was estimated at $14M in multiple digital assets, which the hacker already moved from the initial exploit address. This time, the flaw did not lie with Furucombo directly. Instead, a smart contract communicated with the transaction batching mechanism, managing to re-route the tokens.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">So what happened to Furu\u0441ombo\ud83d\udc47<br><br>An attacker using a fake contract made Furu\u0441ombo think that Aave v2 has a new implementation.<br>Because of this, all interactions with \u2018Aave v2\u2019 allowed transfers approved tokens to an arbitrary address. <a href=\"https:\/\/t.co\/gQVxJqiAmL\">pic.twitter.com\/gQVxJqiAmL<\/a><\/p>&mdash; Igor Igamberdiev (@FrankResearcher) <a href=\"https:\/\/twitter.com\/FrankResearcher\/status\/1365740713334493192?ref_src=twsrc%5Etfw\">February 27, 2021<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>The exploit underlines the risk that assets not directly controlled by a private key can be diverted, if the protocol uses the right credentials.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PAID Network<\/strong><\/h3>\n\n\n\n<p>PAID Network was one of the attacks where the underlying token itself was compromised. Once again, the central error is a smart contract that could be called to action by an outsider.&nbsp;<\/p>\n\n\n\n<p>The PAID smart contract then created 60M new unauthorized tokens, which tanked the asset\u2019s market price. PAID lost most of its value, sinking from a few dollars to a bottom of $0.16. Now, the token hovers around $1.16.&nbsp;<\/p>\n\n\n\n<p>For a while after the attack, the chief advice is to avoid PAID entirely, due to the uncertainty about the bloated token supply and how assets could be considered legitimate to use.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/search?q=%24PAID&amp;src=ctag&amp;ref_src=twsrc%5Etfw\">$PAID<\/a> just got hacked. Tokens currently being dumped on the market. <br><br>Do NOT buy the dip. <a href=\"https:\/\/t.co\/bojdfNxQP8\">pic.twitter.com\/bojdfNxQP8<\/a><\/p>&mdash; CypherPump (@CypherPump) <a href=\"https:\/\/twitter.com\/CypherPump\/status\/1367908364156624904?ref_src=twsrc%5Etfw\">March 5, 2021<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>The protocol creators are still figuring out a compensation. The chief advice for investors is to get out of PAID liquidity pools on all decentralized exchanges, to avoid helping the hacker sell more coins.&nbsp;<\/p>\n\n\n\n<p>One of the chief risks of DeFi is the constant demand for new pools. Enthusiasm and liquidity may be relatively higher for new assets, allowing for a bigger upside. However, new projects are untested both in their honesty and the soundness of their smart contracts.<\/p>\n\n\n\n<p>DeFi is entirely unregulated and decentralized. Unlike exchanges such as Binance and OKEx, the newly created liquidity protocols rarely have insurance. Additionally, decentralized trading and liquidity mining is open to anyone able to pay network gas fees on Ethereum, or simply create a new token and pool through BinanceChain or other protocols.<\/p>\n\n\n\n<p>Exploits in crypto are not new, and have affected token-based startups and smart contracts in the past.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">1\/4 The fast growth of the <a href=\"https:\/\/twitter.com\/hashtag\/DeFi?src=hash&amp;ref_src=twsrc%5Etfw\">#DeFi<\/a> sector has outpaced the infrastructure to support it. In 2020 alone over $150M was compromised from a variety of security exploits discouraging risk-averse players from participating in innovative DeFi protocols. <a href=\"https:\/\/t.co\/jth9pzTUtc\">pic.twitter.com\/jth9pzTUtc<\/a><\/p>&mdash; Lemniscap (@Lemniscap) <a href=\"https:\/\/twitter.com\/Lemniscap\/status\/1367545727635849218?ref_src=twsrc%5Etfw\">March 4, 2021<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>DeFi is simply the new area where malicious actors will try to exploit the new inflow of tokens.<\/p>\n#","protected":false},"excerpt":{"rendered":"<p>DeFi protocols continue to discover flaws and weaknesses, allowing hackers to exploit their smart contracts, steal or mint unauthorized tokens<\/p>\n","protected":false},"author":3,"featured_media":185,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[23,21,5,4,22],"class_list":["post-183","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-defi","tag-binance","tag-binancechain","tag-defi","tag-ethereum","tag-meerkat","entry"],"_links":{"self":[{"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/posts\/183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/comments?post=183"}],"version-history":[{"count":0,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/posts\/183\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/media\/185"}],"wp:attachment":[{"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/media?parent=183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/categories?post=183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tradersofcrypto.com\/news\/wp-json\/wp\/v2\/tags?post=183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}