Partnered With:

Defi protocol domain name hack, how should the user respond?

Read this article in 7 Minutes

As a DEFI investor, we've been walking on thin ice.

Pancake/Cream domain name hack analysis, thinking and response

Distributed Finance Defiant & NBSP;

Let's start with a simple example to understand the process of domain name resolution (some of the more detailed processes have been abstracted to make it easier to understand). Let's say we type in the browser;pancakeswap.finance, & have spent The domain name resolution server (DNS) in the network then resolves the domain name as an IP address, because the server can only be accessed from an IP address on a computer network. Under normal circumstances, the user's browser will access the server corresponding to the IP address set by the project owner. In the case of the hack on the 15th of this month, the number of people killed in the attack has increased.pancakeswap.finance The domain name points to the IP address that the hacker controls, the user's browser visits the server that the hacker controls, and this forgery server asks the user for help to remember the word through the forgery web front end (see the interface below Cream is hacked).

Cream Finance interface when hacked

We have to ask, how did hackers tamper with the DNS records? It starts with GoDaddy, which hosts pancakes and Cream. Pancake/Cream services purchase domain names through GoDaddy and map them to their own server IP addresses at GoDaddy. According to Cream Finance's post mortem report, the hacker attacked GoDaddy, hacked into Pancake/Cream's Godady account, and changed the domain name mapping to change the corresponding IP address to the IP address controlled by the hacker.

DNS Hijack

So who's going to carry the pot? Pancake and Cream are implying that it is a problem with GoDaddy's security mechanism, because Pancake and Cream have not made any changes themselves, and they use Google's single sign-on function to log in to GoDaddy, and their Google account has not been hacked. In fact, GoDaddy's reputation for security is very common among domain name service providers, and there have been frequent accidents in the past. Therefore, as a developer of the Defi project with high security, should we choose a more secure domain name service provider at the beginning? (Pancake said it would replace GoDaddy with a more secure MarkMonitor.)

This incident also highlights the importance of building a decentralized DNS. We don't trust centralized exchanges for fear they'll screw up the crypto assets we store there (Not your keys, Not your coins); We also worry about centralized domain name providers and DNS servers (Not your Key, Not your domain). Web3 technologies such as IPFS/ENS are good decentralized DNS solutions.

As a Defi investor, how do we respond to a domain hack like this? Some of my personal methods:

1. Remember the domain name of the official website, directly enter the correct domain name in the browser (one letter can not be wrong), and re-verify the address opened through the search engine or other links;

2. You need to confirm whether the app is officially released. For example, there were fake UISWAP and Trezor apps in the app store a while ago, which also asked people to input mnemonic words.

3. Websites with the eth. Link suffix have higher DNS security, such as https://cream-finance.eth.link/ , because it is decentralized domain name resolution;