Partnered With:

COVER, a rookie in the DeFi insurance industry, was attacked. How can the insurance industry protect itself?

Read this article in 7 Minutes

What should the insurance company do if it is attacked?

Original title: "DeFi insurance industry rookie COVER is attacked, how does the insurance industry protect itself?" "

Original source: PeckShield

After entering September, with the flow of DeFi protocol The revenue from sexual mining has dropped sharply, the DeFi market has begun to fall silent, and explorers are moving into deeper and wider fields.

In November, with the blessing of Yearn.finance founder Andre Cronje (AC) and the large number of governance tokens Up, the decentralized insurance Cover Protocol has emerged, leading the DeFi insurance station under the spotlight.

There is a point of view that: "DeFi insurance projects can not only reduce the loss of policyholders, but also allow people to Participating in DeFi will help to improve the DeFi ecosystem.”

However, the concept of DeFi insurance is getting more and more speculation When it was hot, Cover Protocol was attacked twice in a short period of time, and its token price experienced a thrilling roller coaster.

On December 28, 2020, the DeFi insurance project Cover Protocol was suspected of being hacked, and its token price was under attack Under the influence of the stock market, it once plummeted from more than 700 US dollars to a minimum of 9 US dollars.

PeckShield (PeckShield) found through tracking and analysis that the attack was mainly due to wrong business logic, which led to miscalculation of pledge User rewards, and selling arbitrage in different DEX.

First of all, within a period of time, the attacker gives some LP tokens to Blacksmith, and then directly Call the function updatePool() to calculate the reward of COVER through the abnormal pool.accRewardsPerToken;

Following through the functions _claimCoverRewards() and of 125 and 126 lines _claimBonus() Record the miner's reward;

Finally record the status of the miner, including the pledged The function rewardWriteoff and function bonusWriteoff are shown in lines 128 to 131 of the quantity and code.

Specifically, the current protocol utilizes pool.accRewardsPerToken to calculate miner.amount.mul(pool .accRewardsPerToken).div(CAL_MULTIPLIER), because the pool type in line 118 is memory, but the function updatePool() in line 121 does not update it, resulting in the final calculated rewardWriteoff being smaller than the expected amount.

When the same user gets the pledge reward next time, the pledge contract such as Blacksmith will mint more COVER, which will Greatly increased the number of coins minted. Currently, more than 40,000,000,000,000,000,000 COVER have been minted in circulation.

The second time the attacker is marked by the network as the address of the Grap Finance white hat. After making a profit, they will The proceeds were returned to the Cover team, and the remaining COVER was destroyed, leaving a message: Next time, mind your own business.

There are comments that the white hat Grap Finance is a DeFi hero and returned 4350 ETH to the COVER team. However, through smashing the market, many investors lost their money, which also caused a lot of controversy.

For DeFi insurance projects, its original intention is to reduce risk losses for other DeFi projects. With the growth of the DeFi ecosystem and the continuous growth of locked positions, DeFi projects have been coveted by hackers, especially the emerging DeFi insurance projects, and security protection should be strengthened. Nowadays, due to its own vulnerabilities being attacked by hackers, it remains to be seen whether such an insurance project can help users resist risks.

In the world of DeFi, "Code is Law" is advocated. The code should be made to the extreme, and it is necessary to prevent problems before they happen. DeFi protocol developers should check the code by themselves after the attack occurs. PeckShield reminds that if you don't understand this, you should find a professional auditing agency for auditing and research.