Partnered With:

A Review of DeFi Attacks in 2020

Read this article in 17 Minutes

Taking stock of the troubled 2020

Original title: "An average of 1 attack per month, involving 120 million US dollars of funds, a large inventory of DeFi attacks in 2020"

Original source: Babbitt

DeFi is the star of the crypto economy show in 2020. A historic year. That being said, 2020 has also seen a new wave of sophisticated attackers come to probe and steal tokens held by young DeFi projects. Let’s take a look back at the largest and most “successful” DeFi attacks of the year.

(Translator's Note: This article is a brief review of the attack, for specific content, please refer to the detailed review link in the text.)

The first vulnerability of bZx - February 15

Attack type: Exploitation

Amount of loss: About US$356,000

Recovered funds: None

Detailed review

In this attack, criminals used flash loans through dYdX to initiate a permissionless "pump and dump" scheme involving WBTC and bZx, Compound, KyberSwap, and Uniswap projects. Subsequent operations allowed the attacker to get away with more than 1200 ETH.

(5 combinable DeFi protocols in bZx attack, source: Paidun)

Following bZx prophecy Machine Rapid Attack - February 18

Attack Type: Oracle Control

Loss Finance: Approximately $666,000

Funds recovered: None

Detailed review‌

Days after bZx was first attacked, the attackers launched another flash loan attack on the protocol. This time it involved manipulation of the oracle machine of Synthetix’s sUSD token. The attacker also raised the price of the sUSD token, and then lent ETH from bZx.

(5 combinable DeFi protocols in the second bZx attack, source: Paidun)

Uniswap Reentrancy attack with Lendf.me - April 18-19

Attack type: Reentrancy via imBTC

Amount lost: more than $25 million

Funds recovered: about $25 million

Detailed review‌

In April 2020, Tokenlon, the issuer of imBTC, was at the center of two reentrancy attacks, the first from Uniswap V1 (the loss amount was small), and the second from dForce’s Lendf. me agreement to steal $25 million. This DeFi attack revolves around the "hook" mechanism of ERC-777. If tokens are deposited into an agreement that does not eliminate the hook itself, it may cause the tokens to be used by malicious contracts. Notably, the Lendf.me attackers eventually returned the tokens stolen from the protocol after their IP addresses and other identifying information were revealed.

Bancor Rescue - June 18

Attack Type: Unlimited Approval + Public Method Visibility

Amount Lost: About $135,000

Funds Recovered: About $13.5 million US dollars

Detail review‌

This severe vulnerability of the Bancor network means that many users will unsuspectingly approve a smart contract indefinitely, and this contract may This would allow anyone to publicly steal funds from Bancor users. In cooperation with white hat hackers, Bancor discovered this vulnerability and immediately tried to "exploit" it to prevent malicious agents from doing the same thing in the first place. Automated front-running bots accidentally joined in, unknowingly helping Bancor save money, and the holders of those bots promptly returned those funds to Bancor.

Deflationary Attack on Balancer - June 28

Attack Type: Deflationary Tokens

Amount of loss: about $522,000

Funds recovered: None

Detailed review ‌

In this incident, a very clever DeFi hacker launched a sophisticated flash loan attack on Balancer. Hackers made transactions through Tornado.cash, an Ethereum privacy solution. The scheme itself targeted STA and STONK deflationary tokens and their transaction fee mechanics, which allowed hackers to steal $500,000 worth of ETH, LINK, SNX, and WBTC.

Opyn’s Double Execution – August 5th

Attack Type: Vulnerability Exploitation

Amount of loss: about $371,000

Funds recovered: None

Review for details ‌

The DeFi option protocol Opyn is the victim of this hacker attack. The hacker used the loophole to "double exercise" the project's oToken. Opyn quickly patched this attack vector, but the attack still resulted in the theft of over $370,000 in USDC collateral from the smart contract.

bZx’s iToken duplication event—September 15th

Attack type: Exploitation

Amount of loss: about $8 million

Recovered funds: about $8 million

Detailed review< /a>‌

In this attack, the hacker exploited a vulnerability in bZx's iToken system code to "artificially inflate his balance". This incident highlights that smart contract audits cannot guarantee that DeFi is completely safe, just like bZx had already passed the audits of Paidun and Certik before it was attacked. Fortunately, bZx managed to recover all the lost funds from the attackers.

Eminence oracle attack - September 29

Attack type: Oracle manipulation

Amount of loss: about $15 million

Recovered funds: about $8 million

Detailed review< /a>‌

Eminence Finance is an NFT-based game developed by Yearn creator Andre Cronje, before its developer announced information about the project It has already attracted a lot of attention on the chain. This led to DeFi degens imitating the project, throwing caution to the wind and creating a sizable trove of tokens, with a hacker quickly stealing funds through a flash loan-powered oracle manipulation attack. The attackers eventually returned $8 million of the $15 million stolen money, which was distributed through a community refund mechanism.

Harvest Finance oracle attack - October 26

Attack type: Oracle Manipulation

Amount of loss: about $24 million

Funds recovered: about $2.5 million

Review for details ‌

In late October, Harvest Finance, a revenue aggregation protocol, suffered an oracle manipulation attack. The attacker obtained more than 2,400 Ten thousand U.S. dollars. Specifically, the protocol’s USDC and USDT smart pools are the target of DeFi attacks, mainly focusing on the impermanent loss of the Curve.fi Y pool.

Cheese Bank Robbery - November 6

Attack Type: Oracle Manipulation

Amount of loss: about $3.3 million

Funds recovered: None

Review for details ‌

Decentralized autonomous bank Cheese Bank has stolen over $3 million worth of Dai, USDC and USDT in a sophisticated flash loan attack.

Akropolis Attack - November 12

Attack Type: Vulnerability Attack + Reentrancy

Amount of loss: approximately $2 million

Funds recovered: None

Detailed review ‌

Attackers used a reentrancy attack combined with a vulnerability in the storage pool of the Akropolis project to steal $2 million worth of Dai stablecoins. Certik, Pessimistic, and SmartDec had already audited the pool before the attack, reminding us once again that an audit does not absolutely guarantee DeFi security.

Value DeFi oracle attack - November 14

Attack type: oracle Manipulation

Amount of loss: about $7.5 million

Funds recovered: about $2 million

Review for details ‌

This incident came just after Value DeFi made a pretentious claim that one of its advantages is greater security. Following the attack, the project team announced plans to integrate with the decentralized oracle network Chainlink.

Origin Dollar Reentrancy Attack - November 17

Attack Type: Vulnerability Exploitation +Re-entrancy attack

Amount of loss: about 7.7 million US dollars

Funds recovered: None

Review for details ‌

In November, the stablecoin project Origin Dollar also became a victim of a flash loan attack. The attacker used a malicious contract to create a large amount of OUSD. After the incident, the Origin Dollar team offered a reward of $1 million for clues.

Pickle Finance's **** Trouble - November 22

Attack Type: Vulnerability Exploit

Amount Lost: About $19.7 Million

Funds Recovered: None

Review for details ‌

In November last year, nearly 20 million Dai was stolen from the pDAI PickleJar of the revenue aggregation protocol Pickle Finance. The sophisticated attack was carried out by the attackers installing an "Evil Jar" in the pDAI system, which was used to steal funds from pDAI.

(Pickle's Evil Jar attack, source: banteg)

Warp Finance oracle attack - November 22

Attack type: Oracle manipulation

Amount of loss: approximately US$7.7 million

Funds recovered: approximately US$5.85 million

Review‌

DeFi lending platform Warp Finance was attacked in oracle manipulation and more than $7 million was stolen. Due to a quirk in the project's design, the team was able to get back the coins used by the attackers as collateral, namely $5.85 million worth of ETH/DAI LP tokens.

Summary

The above-mentioned attacks involved more than $120 million in stolen funds. 2020 has been a boom year for DeFi, and as the industry’s rise has taken center stage, attackers have turned their attention to the space accordingly. From the above attacks, it is clear that there is no single method of attacking DeFi protocols, but some common attack vectors that have led to some young DeFi projects falling prey. So far, the toll from these growing attacks has not been catastrophic. However, as the ecosystem continues to develop and the total locked-up volume expands, the designed funds will become larger and attacks will be more profitable. At least it can be expected that 2021 will see more sophisticated DeFi attacks.