Partnered With:

Will the USDC be the next Defi crisis?

Read this article in 6 Minutes

The risk for the USDC is that its agent contract, which has administrator rights, could be compromised and the DeFi project that integrates with the USDC could be attacked.

Original title: "decentralized finance, not what we think"

Post by wei xiong, engineer, imToken backend

After the lendf.me theft, we learned that the ERC777 token contract and the common loan pool contract combination can create a loophole, as imToken Simon said: "the wine is right, the cephalosporin is right, put together, killed." The incident eventually resulted in the theft of $25 million (170 million yuan), which was eventually recovered, but left a deep impression on our minds and forced us to review the security of smart contracts.

Coyote founder pro DeFi thunder experience and lessonsThe risks of using decentralised finance have been thoroughly analysed. Looking back at our other decentralized projects, are there any other problems with them?

In our investigation, we found that in ethereum's decentralized financial scenario, a large number of projects were integrated with the USDC. In its token implementation, the USDC adds a pre-agent contract. Simply put, when we use the USDC contract to transfer money, we access the agent of the USDC, and the agent accesses the target contract of the USDC through the address set internally.

The agent contract has an administrator authority to change the target of its agent, and can use administrative authority to replace the target contract address when the contract needs to be upgraded. This is a design model of scalable and interchangeable smart contracts, which solves the problem of contract upgrading, but also creates huge risks.

If the administrative rights of the agent contract are compromised, this means that an attacker can point the agent's target address to any address. An attacker can easily forge an attack contract that can issue tokens at will and then point the proxy contract to the attack contract. As a result, once the USDC agency contract is breached, the Compound pool can be siphered away, just like lendf.me. Even MakerDAO, today's largest stable currency platform, can generate stable currency incorrectly by attacking the USDC proxy contract. This risk exists for any platform that integrates with the USDC. The USDC is being used on a large scale in decentralized applications.

As more tokens use the proxy pattern, each token becomes an attack vector, and if a decentralized project continues to integrate similar projects, its security is compromised. By contrast, the way in which the administrator's key is destroyed appears more robust without the use of a proxy contract.

Decentralization requires more trust than traditional applications. Because the smart contract automates all processes, it requires complete trust between all code in the process of creating code. Token projects such as the USDC itself have a certain centralization attribute. When applied to all projects on a large scale, all the trust of these projects will be concentrated on a single centralized point. This single point of control is the godlike model for the entire decentralized ecology. At this time, the key leakage of a single point of agency contract may cause the collapse of the whole decentralized ecology, resulting in the hacking of countless items and the loss of countless tokens. In contrast, a centralized single point, while not hacked, has the authority to control the entire decentralized ecosystem, and a token manager can use the same approach to disrupt or shut down any project that integrates it.

It can be seen that in the large-scale application process of the USDC, the risk of the whole decentralized ecology is all concentrated in the agency contract of the centralized control of the USDC, which provides the management organization of the USDC with the god model of the whole ecology. Maybe what we call decentralization is more centralized than traditional projects?

If decentralisation is still in its early stages, the USDC is the king of the wild in this wilderness.