Restoring the horror night after Pickle Finance was attacked
Original source: Rekt
Original title: " Pickle Finance's $20M Stolen Revelation "
Translator: Free and Easy-Babbitt
Translator's Note: This Saturday, the DeFi protocol Pickle Finance was hacked for $20 million because of the loopholes in its Jar strategy. The remaining vulnerable $50 million in user funds was rescued, as author Rekt summarizes the incident.
The fermentation of finance is still going on, even pickles have a shelf life.
Pickle Finance was hacked for 19.7 million DAI due to a fake "Pickle jar" vulnerability.
Pickle Finance has become the latest victim of the hacking pandemic.
This time, however, something is different...
When people on Twitter Trying to come to terms with yet another financial disaster, Rekt launched an investigation.
We contacted the Stake Capital team who reviewed the code and warned us that other pickle jars may be at risk.
Then, we quickly contacted the Pickle Finance team with members from Sketch Capital (@bneiluj, @vasa_developer) and experienced developers @samczsun, @emilianobonassi A war room was built between them.
After our investigation, it became clear that we were seeing something very different from the DeFi LEGO style hacks of recent weeks.
This is not an arbitrage.
The attacker has a good understanding of Solidity and EVM, and may have been paying close attention to the Yearn code for a while, because this vulnerability is related to a month ago in Yearn Vulnerabilities found in are similar.
Essentially, Pickle Jar is a fork of Yearn yVaults, these Jars are controlled by a contract called the Controller, which has the ability to allow users to Functionality for exchanging assets between Jars.
Unfortunately, Pickle does not have a whitelist of which Jars are allowed to use this swap.
The hacker created a fake Pickle Jar and exchanged the funds in the original Jar. This is possible because swapExactJarForJar does not check "whitelisted" jars.
The Pickle Finance team knew they needed help and were more than willing to work with others to prevent any further damage.
Pickle tried to call the 'withdrawAll' function, but the transaction failed.
This withdrawal request needs to go through the governance DAO, which has a 12 hour timelock.
Only members of a Pickle multisig group had the ability to bypass this timelock while they were sleeping.
This means managers cannot empty the Pickle Jar, but it doesn't protect them from another hack.
Pickle Finance and Curve subsequently issued warnings asking users to immediately withdraw funds from Pickle, however, $50 million remained in potentially vulnerable Pickle jars , while a white hat team investigated the breach and checked the safety of the remaining funds.
The rescue team must either wake up the sleeping admin, or drain the jars themselves.
The team had to overcome 5 major challenges:
Getting the Pickle Finance team together across multiple time zones Together, to rescue these funds by pushing transactions to 12 hour timelocks (via 3 out of 6 multisigs) to withdraw funds; let thousands of investors withdraw their funds (and prevent them from pooling TVL drop and APY balloons above 1000% before reinvesting); do security checks on other jars to see if more attacks are likely to occur; before anyone attacks these jars again, replicate this attack, move funds out ;Avoid front-running while trying to salvage the remaining $50M in funds;
How long can we continue to rely on the help of pseudo-anonymous white hat hackers?
Obviously, the motives of the attackers are more consistent than those of the protectors, so why would the white hat hackers coordinate such an arduous counterattack?
It is not sustainable that the credit goes to the white hats and the money goes to the hackers.
How long will it take for these white hats to turn black?
Analysis
< /p>
By publishing this technical information, we realize that we may trigger new hacking attacks. We discussed the potential ramifications with Pickle Finance and other developers, and confirm that we are not aware of any operational fork of Pickle that could be affected by a copycat attack.
Selective disclosure brings an aspect of responsibility, so we have decided to release this information freely. If any protocol is running a fork of Pickle's code, they should be aware of what's going on and take precautions to protect against copycat hackers.
The diagram below was created by @vasa_develop.
Original files can be found at Found here.
For more details, please refer to the official Report.
It will be interesting to see how relatively new insurance protocol Cover Protocol handles this incident, which is huge for their first claim amount. You can find snapshot ballots for insurance claims here.
Pickling pickles is a slow process.
For decades, advocates of "agile development" have been telling developers to move fast, fail fast, and ship a minimum viable product.
These ideas are not suitable for building in a hostile environment.
Failing fast in DeFi comes at a huge cost.
We don't need another approach, we need a paradigm shift that allows for rapid iteration while reducing the likelihood of being attacked.
Let's stop thinking "you have auditing and you have security", it's a checklist security measure applied to moving targets in most cases Snapshots of those goals, which often morph into something else shortly after the project hits mainnet.
MixBytes (October 3) and Haechi (Oct 20) audits were done before ControllerV4 was added (Oct 23) and ControllerV4 is one of the key vectors of this attack.
The greatest teams in the financial world in the future will be those that can balance between fast iterations and safe iterations. Money Robots undergo continuous auditing and rigorous testing.
Auditing should be a regular, ongoing process, not a pre-start tick. New DeFi protocols are constantly changing and adapting, and security audits should reflect this.
After all, pickles stay fresh only in jars...
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
Related Articles
