Partnered With:

PeckShield: There were a total of 20 security incidents in June, and DeFi security issues are again prominent

Read this article in 18 Minutes

As the DeFi project becomes more and more versatile, the hidden security issues are becoming more and more apparent, and the security issues for the DeFi project are very serious given its close relationship to user assets.

Original title: PeckShield: 20 Security incidents in June, DeFi Security Again highlighted

Source: PeckShield

DeFi security

Four DeFi security incidents occurred in June, as follows:

1) Balancer pool, a well-known DeFi platform, was hit by a hacker lightning loan attack and lost $500,000. PeckShield security stepped in and quickly identified the nature of the problem as a result of the fact that deflated tokens in Balancer and their smart contracts were incompatible in certain scenarios, allowing attackers to create price-off STA/STONK circulation pools. (For details, see PeckShield: DeFi Platform Balancer.)

There are four steps in this attack, specifically:

1) The attacker has lent 104,331 WETH through lightning loan from dYdX platform;

2) The attacker performs the swapexactMountin() call over and over again until Balancer runs out of most of the STA tokens in its possession and moves on to the next attack. Balancer ended up with only 0.000000000000000001 STA left.

3) Attackers took advantage of incompatibility between STA scrip and Balancer smart contract -- bookkeeping and balance mismatches -- to attack, depleting other assets in the pool, and ending up with $523,616.52 worth of profitable digital assets.

4) The attacker repaid the lightning loan from dYdX and walked away with the digital assets obtained from the attack.

(Diagram of the whole hacking process)

2) Frenzy_hao, DeBank engineer, tweeted today that hackers had again taken advantage of dYdX's lightning loan to attack Balancer, part of the COMP trade in the pool of liquidity, to take the uncollected COMP prize from the pool and make a profit of 10.8eth.

3) Decentralized Agreement The details of the security loophole were officially disclosed by Bancor. The safeTransferFrom function, which should have been set as private, was defined as public function, so anyone could transfer the token. Fortunately, there was not much security loss, and the team launched a white-hat attack after discovering the vulnerability in order to transfer funds to a secure address.

4) On June 21st Samczsun, a security researcher, privately revealed two flaws in the contract and loan agent currently deployed by AtomicLoans. These two vulnerabilities could allow a borrower to unlock some or all of BTC's collateral under certain circumstances without repaying the loan.

PeckShield review:As the DeFi project becomes more and more versatile, the hidden security issues are becoming more and more apparent, and the security issues for the DeFi project are very serious given its close relationship to user assets. As each project is developed by different teams with limited understanding of the design and implementation of each product, the integrated product is likely to have security problems in the process of interacting with the third-party platform, and thus suffer from both sides. PeckShield recommends that the DeFi project side conduct a full security audit with a team that has done in-depth research on all aspects of DeFi's product design before going online, as far as possible, to avoid potential security risks.

Digital Wallet Security

A total of 1 wallet security incident occurred in June:

1) Researchers at cyber security firm OpenZeppelin have posted that they have identified a high-risk vulnerability in The Ethereum wallet Argent. Vulnerabilities allow an attacker to take over a user's wallet, especially if the "daemon" feature is not active. Meanwhile, the Argent team quickly fixed the bug and contacted the affected users.

PeckShield review:As a tool for managing private keys, a digital wallet is the closest place to an encrypted asset. While a cold wallet is an offline wallet that is disconnected from the Internet, it is also at risk of physical attack and theft, while a hot wallet like a web wallet also requires users to be wary of phishing, malicious code injection and other attacks.

Public security chain

A total of 1 public chain safety incident occurred in June:

1) Blockstream commercial side chain Liquid Network has been exposed to security vulnerabilities. Due to the inconsistent hash time, important accounts in the network can be affected by a technical vulnerability, which can lead to hundreds of dollars of BTC theft. Currently, administrators of the Blockstream network have temporarily seized 870 Bitcoins stored on The Liquid network by restoring multi-signature contracts.

PeckShield review:Once the vulnerability of the public chain is found, it will have a great impact on the whole chain ecology. Therefore, the public chain must do security testing and vulnerability detection before the official version is launched, and seek the audit of a third-party security company, so as to avoid the impact of vulnerability threat on the public chain ecology.

Blackmail associated

There were 4 security incidents related to extortion in June:

1) Researchers at the security firm Unit 42 have discovered that a new malware called Lucifer, a variant of an old cryptocurrency ransomware, is spreading. New variants can be used for malicious cryptocurrency mining, but can also be used for DDoS attacks.

2) The US subsidiary of ST Engineering Aerospace was hit by a ransomware attack in which 1.5TB of sensitive data was stolen by the company and its partners. The move follows news in February that hackers have broken into five US law firms to demand a ransom of more than $933,000 BTC. The move follows news in March that Maze, an encrypted ransomware group, was using hacking software to attack insurance giant Chubb.

3) Kent Commercial Services (KCS) was recently hit by a blackmail attack by hackers, who demanded a ransom of £800,000 in Bitcoin or risk exposing the company's data on the dark web. KCS said no ransom had been paid and no personal data had been stolen from taxpayers.

4) Researchers at PeckShield Security believe that two unusually high eum fee transfers could be the result of a blackmail attack on GoodCycle, a fake transaction platform based in South Korea. The hacker obtained part of the rights of the trading platform through phishing attacks, so he used the behavior of squandering GasPrice to carry out extortion. (For details, see behind ethereum's sky-high fee transfer: A hacker-initiated GasPrice extortion attack? Ethereum sky-high fee transfer truth: GoodCycle, a fund disk project, staged a manslaughter conceit!

PeckShield review:Extortion security incidents have been a major hidden danger affecting the entire Internet ecology, not limited to the blockchain ecology. Moreover, after the popularity of cryptocurrencies in the blockchain field, criminals often take advantage of the good anonymity of cryptocurrencies such as Bitcoin to commit extortion fraud.

Fraud running incident

In addition to the above, a number of fraudulent run-away incidents occurred in June, such as:

1) According to data from CoinHolmes, a digital asset visual tracking platform owned by PeckShield, since the afternoon of June 22nd, PlusToken running fund has changed, with 26,316,339 EOS and 2,503 BTC; 789,533 ETH were transferred.

2) Seoul, South Korea, police today launched an investigation into two anonymous digital currency trading platforms involved in ETH crimes, in which criminals used a multi-layered Ponzi scheme to trick victims out of their digital currency. 433 investors, worth $41.5 million, have complained to police and 1,000 have not yet contacted them.

3) Bitisis, an Iranian trading platform widely reported in The Chinese media, has run away, with multiple sources pointing out that the actual operator behind itis a Chinese fraudster, and has several overseas trading platforms that claim to be able to arbitrage away retail funds. At present, the local police have a case. The trading platform transferred users' assets to three addresses, one of which was frozen in an emergency.

4) Bibox official announcement, there are criminals shanzhai Bibox APP, posing as Bibox customer service, to induce users to trade, please be vigilant.

5) Huobi Global Station received a report that a phishing scam website posing as Huobi issued a notice to spread the "ERD airdrop" in the community. Huobi global Station solemnly states that Huobi has not issued any information regarding "ERD airdrops". Traders are advised to be vigilant and recognize Huobi's official website address.

6) The Matcha trading platform issued an announcement saying that recently, criminals have posed as customer service personnel of several trading platforms and created fraudulent websites to induce users to trade or require them to transfer digital assets to the fraudulent websites. There is no official WeChat ID for MXC matcha. Any "MXC matcha" account on WeChat is an unofficial account. In case of contacting users in the name of MXC Matcha and asking them to "transfer digital assets" to other platforms, their identities can be verified through the customer service channel of MXC Matcha's official website.

7) Recently, the police in Yantai, Shandong province, shut down a criminal gang in Shenzhen, Huizhou and Hefei that used a fake investment platform to commit fraud, involving more than 14 million yuan.

8) shandong heze city public security bureau of the juye has uncovered a major telecom network fraud, abort multiple suspected of network of lending and investment "COINS" name of the implementation of telecom network fraud gang, captured the criminal suspect, 83, detainment or freeze the funds more than 2700 ten thousand yuan, the current 30 major suspects have been juye police transferred to the procuratorial organs in accordance with the examination and prosecution.

9) Recently, an OTC dealer in Nanning was arrested by the police for suspected assistance in money laundering of telecom fraud criminals. This shows that the combination of USDT, cryptocurrency and telecom fraud is becoming more and more closely in China, which may bring more risks of freezing CARDS to ordinary users, and OTC companies also need to strengthen screening.

10) The name of Tesla founder Elon Musk and his company SpaceX are reportedly being used in a Bitcoin scam on YouTube. A total of 214 BTCS, worth more than $2 million, were sent to such fraud addresses, according to the report.

DeFi Money Market Protocol (DeFi) DMM's official Twitter account says that during the public offering its telegram group was hijacked in a malicious attempt by an imposter who took the place of DMM Foundation in order to steal money. The corresponding DMG amount is compensated to those who are cheated in token sales, and those who want to ensure that all financial losses are compensated accordingly.

PeckShield review:Due to users' lack of security awareness and normative operation, all kinds of security risks emerge endlessly. Phishing attacks, frauds and other events are typical. It is hereby reminded that users should keep all kinds of private information carefully. Any small negligence may cause irreparable loss.