DeFi, Vulnerability of Balancer: 500,000 dollars lost!
DeFi: An increase since the beginning of 2020
Is the hacker an expert?
The liquidity provider of decentralized finance (DeFi), Balancer Pool, has been hacked for more than 500,000 dollars in a single Ether (ETH) transaction. He admitted early on Monday, June 29, 2020 that the hacker managed to steal nearly $500,000 from the automated market protocol.
DeFi: An increase since the beginning of 2020
The DeFi sector has been facing difficulties since the beginning of 2020. Fortunately, the trend has been on the rise in recent weeks; decentralized finance has never even been better, while at the same time accelerating dramatically.
New protocols, such as the launch of the COMP and BAL governance tokens, are appearing and allow users to achieve high returns.
According to DeFi Pulse, there has been an impressive evolution of DeFi related figures with approximately $1.63 billion in crypto-money deposited in and through DeFi applications.
DeFi has outperformed the traditional cryptocurrency markets so far this year with a 140% gain in TVL, while the total market capitalization for all cryptographic assets has only increased by 36% since the beginning of 2020.
We will first present the history of Decentralized Finance.
DeFi appeared in April2019 and follows the failure of the fiat protocol tokens and ICOs and the valuation of MakerDAO and Compound companies which succeeded in raising significant funds from the elite of the Silicon Valley venture capital firm, Andreessen Horowitz. Since then, decentralized finance, or DeFi, has become a word to follow in the world of crypto-currency because it meets a need among users.
DeFi represents an ecosystem based on different open and public protocols, mainly Ethereum, where everyone could benefit from different financial services and products without any control bodies:
- “By allowing you to borrow cryptos using cryptos as a guarantee;
- Using this loan market to earn interest on your cryptos assets;
- Negotiate cryptos via decentralized exchanges, or DEXes;
- Commit your cryptos to liquidity pools, in exchange for a percentage of the fee;
- Insure you against hacking in some way…
Anticipating hacking by being hacked herself?
This is not the first time that the DeFi ecosystem has been exploited. For example, 2020 was even a rather difficult year for decentralized finance:
In February, a hacker used a loophole in the platform to embezzle over half a million dollars.
Then, towards the end of April, dForce’s Lendf.me ecosystem protocol lost 99.95% of its funds due to a hacking exploit. The cyber-attack came less than a week after dForce announced that it would use the new investment funds to expand its team and focus on developing its product offerings.
25 million from Bitcoin (BTC) and Ethereum (ETH) was stolen from dForce’s Lendf.Me loan protocol, as hackers exploited a security hole in an ERC777 imBTC token embedded in the system.
Is the hacker an expert?
This time it’s about the Balancer protocol being the victim of the hackers. Mike McDonald, one of the co-founders and CTO of Balancer Labs, confirmed in a blog post that $500,000 worth of cryptocurrency had been stolen.
He explained that the hacker had borrowed $23 million worth of WETH tokens, an ether-based token suitable for DeFi trading, as part of a flash loan from dYdX. They then traded against themselves with Statera (STA), an investment token that uses a transfer fee model, and burns 1% of its value each time it is traded.
So the hacker tricked the protocol by manipulating the intelligent contract of a pool in such a way that he was able to get into debt.
Next, the hacker exploited a vulnerability to remove Wrapped Ethereum, Wrapped Bitcoin, Synthetix and Chainlink from the pool, and finally reduced the DeFi protocol by about 500,000 US dollars.
According to Exchange 1inch, a decentralized exchange aggregator:
“The attacker used the funds to exchange WETH (Wrapped ETH) for STA(Statera) and vice versa 24 times. As a result, the STA pool remained empty.
On each exchange of WETH for STA, the Balancer pool received 1% less STA than expected.
As a result, the hacker could easily remove the WETH, WBTC, SNX and LINK chips from Balancer’s smart contract. The attack was made possible by the deflation mechanism built into the STA, which burns 1% of the amount transferred in each transaction.
In addition to WETH, the attacker made the same attack using WBTC, LINK and SNX, all against Statera chips.
It is not yet known who was behind this hack but according to 1inch exchange analysts: the ether used to pay transaction fees and deploy smart contracts was laundered by Tornado Cash, a mixing service based on Ethereum.
For his part, Balancer claimed that this attack was not carried out by an amateur, but by an expert, fully aware of his actions and their consequences:
“The person behind this attack was a highly sophisticated and intelligent smart contract engineer with a thorough knowledge and understanding of the main Challenge protocols. The attack was organized and well prepared in advance. »
Despite this, the decentralized financial markets remained at their highest level in terms of total blocked value, and according to the STA team, Balancer was aware of the problem with transfer tokens like Statera a few days before the incident.
Written by Laetisia Harson, Project Manager at Magna Numeris
