PeckShield: there were 19 security incidents in March, highlighting security issues at DeFi

Original title: PeckShield: 19 security incidents in March, DeFi security issue highlighted

Source: PeckShield

DeFi security

There were two DeFi security incidents in March, as follows:

1) on March 12, MakerDAO's large mortgage debt holdings fell through the clearing threshold due to the price collapse of ethereum ETH, triggering the liquidation process. Due to the soaring of ethereum network gas fees, the liquidation process of MakerDAO was completely lack of competition. The liquidation bot (Keeperbot), which should have participated in the liquidation process, was blocked in bidding due to the low gas value set. A Keeper won the auction with 0 DAI's bid when there was no competitor.

The MakerDAO clearing auction was designed to recover the maximum amount of DAI with as little collateral as possible, a mechanism that would normally work successfully. However, when the ebeneum system is extremely congested, or even more extreme, as long as the bidding participation is insufficient, it is easy for a malicious Keeper to get the auction at a very low price. The MakerDAO community has also urgently discussed measures to improve the clearing mechanism.

2) on March 26, Synthetix mortgage settlement function was found a loophole, specifically: Synthetix recently launched a contract, the user can in 3 months probation ETH pledge obtain sETH, but at the end of the probation period, will start to close all loan function liquidation, an arbitrary sETH users can get ETH interface by calling the liquidation. However, a bug in the interface's processing logic code could cause any user to directly burn the borrower's sETH assets and get the ETH. But because the feature was on trial, it didn't actually hurt. Loan service on Synthetix's website remains closed.

PeckShield review: as the DeFi project becomes more and more versatile, the underlying security issues are coming to light, and the security issues for the DeFi project are significant given its close relationship to user assets. As each project is developed by different teams, and the understanding of the design and implementation of each product is limited, the integrated product is likely to encounter security problems in the process of interacting with the third-party platform, and then suffer from both sides. PeckShield recommends that DeFi project parties conduct a full security audit with DeFi product design teams as closely as possible to avoid potential security risks before launching.

Exchange security

Two exchange security incidents occurred in March:

1) on March 2, the U.S. department of justice indicted two Chinese men, tian yinyin and li jiadong, for conspiracy to launder money and operate remittances without a license, and froze all their assets. PeckShield, a blockchain security company, was the first to step in with the tracking analysis, tracing the entire case back and forward, collecting evidence and visualizing the entire case based on only 20 addresses published by the U.S. department of justice.

The analysis found that the attackers tried to use the Peel Chain technology to break up the assets in their hands into small assets and store these small assets in the exchange, as shown in the following figure:

After completing the initial money-laundering operation, the attacker did not directly transfer the original illegal gains of BTC to his own wallet, but used the Peel Chain technique again to transfer the original illegal gains of BTC to the OTC exchange for cash in batches. Each time, the attacker only separated dozens of BTC from the main account and deposited them into OTC account for cash. After dozens or hundreds of operations, thousands of BTC were finally confused and cleaned successfully. (for details, see hardcore: declassifying U.S. department of justice lawsuit against Chinese OTC acceptor for money laundering)

2) OMNI network found a new USDT false recharge technique: hackers take the issue of other types of tokens forged as USDT to the exchange or wallet USDT false recharge, when the exchange or wallet in the detection of USDT recharge if there is no verification of the propertyid in the transaction, will lead to false recharge.

PeckShield review: hackers who steal assets and then launder them, no matter how elaborate, typically use exchanges as part of a cash-out channel. This undoubtedly raises the requirements for the KYC and KYT businesses of the major digital asset exchanges, which should strengthen the review of AML anti-money laundering and fund compliance. At the same time, for security problems such as false recharge, the exchange should confirm the token name and transaction status before the transfer.

Intelligent contract

In march, there was one smart contract security incident on the ethereum network. Specifically: on March 24, a project party reported that after the release of ERC20 tokens, some tokens of unknown origin were found to be transferred on the chain. After in-depth analysis, it is found that there is a backdoor in the "one-key coin issuing" third-party platform used by the project party -- there is a bad behavior of secretly issuing tokens and stealing when the coin issuing contract is created.

PeckShield comments: when using third-party services to complete the development of the smart contract, the project must do security testing before the contract goes online. If necessary, the project can ask the third-party security company to complete the audit and evaluation to help it complete the attack testing and basic security defense deployment before the contract goes online.

Fraud escape incident

In addition to the above, there were also a number of cases of fraud running away in March. For example:

1) block chain fund dish "silicon valley block chicken" is suspected to have run away, involving a sum of up to 10 billion RMB;
2) British couple lose 14,800 XRP due to fake Chrome extensions;
3) criminals release virtual currency news in various chat groups, take advantage of the urgent psychology of people's investment and financial management under the pretext of epidemic prevention and control, and conduct fraud and illegal fund-raising activities under the guise of virtual currency;
4) someone on YouTube posed as Ripple's CEO to sell 50 million XRP tokens as a fake giveaway to trick users into putting their money into a similar airdrop scam.

PeckShield comments: due to the lack of security awareness and operation standards caused by a variety of security risks have been emerging in an endless, phishing attacks, fraud and other types of incidents are typical. Remind here, the user should be careful to keep all kinds of private information, any small negligence may cause irreparable loss.

Original link:https://mp.weixin.qq.com/s/CAouLjd8zlF4pByD2uWZ1Q

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia