The DeFi world is riddled with security problems. Can Immunefi, the hacker bounty hunter platform, solve them?
Original author: Old Yuppie
Three years ago, the total value of cryptocurrencies locked up in DeFi was just $800 million. By February 2021, that number had grown to $40 billion; It reached the $80 billion milestone in April 2021; Now, it's more than $246 billion. This new track captures a rapid increase in the value of capital mobility.
From a hacker's point of view, an attack on the Defi ecosystem is an ideal and quick way to get rich, which has apparently become an amusement park for hackers and fraudsters of all kinds. As of the end of July, DefI-related hacks had cost users $361 million, According to CipherTrace's latest "Crypto Asset Crime and Anti-Money Laundering Report." What is their main technique? And what should we do about it.
How was DeFi funds stolen?
REENTRANCY ATTACK
A striking example is the DForce hack that took place on April 19, 2020.
On DEFI protocol, the smart contract has the following four withdrawal steps:
1. The user invokes the contract and prepares to withdraw all funds from the contract.
2. Contract checks whether the user has funds in the contract.
3. The contract sends the user the funds in the contract.
4. The contract is updated by itself, and the user has no funds in the contract.
A reentrant vulnerability allows a hacker to invoke the contract again (" reentrant ") before it is fully executed. In the example above, the attacker could re-enter the contract between steps 3 and 4 and exit again before the user balance is updated. By repeating this process, they were able to withdraw all existing funds from the contract, repeatedly withdrawing funds in a cycle to steal $25 million.
FLASH LOAN ATTACK
Recently, lightning attacks have become the most popular method of hacking. Flash loans are loans that are valid for only one blockchain transaction, with no risk of default. It means that the lender agrees to lend any amount to the borrower, provided that the amount is returned to the lender within a given time, otherwise the lender can roll back the whole deal. Hackers circumvent lending mechanisms, which open up all sorts of vulnerabilities, such as asset price manipulation.
Flash loan attacks abuse the security of a platform's smart contracts, often by borrowing large amounts of money that does not require collateral. They then manipulate the price of cryptocurrency assets on one trading platform and quickly resell them on another
Smart contract loopholes
Coding errors result from carelessly performed smart contract security audits or unchecked smart contract vulnerabilities and vulnerabilities. Regrettably, many blockchain project founders decide to run their projects with inadequate test coverage and ignore the relevance of security audits, an oversight that leads to increased likelihood of attacks and losses for investors.
Manipulation of Price Predictor (Oracle) : Representative example Maker Dao
Execution of smart contracts depends on accurate data provided by Price Oracle. However, access to such price data is not as secure and reliable as one might hope. If Oracle provides inaccurate data, the smart contract will cause the transaction to be executed incorrectly. This fact plays into the hands of hackers who try to manipulate prices in their favor. It is a typical attack of a prophet to manipulate the information sources relied on by the prophet to achieve a misleading price in the chain for a short time. Its essence is to control the prophet, cause the difference between internal and external prices, and use new financial instruments such as lightning loan to arbitrage.
Emerged as The Times arise Defi bug bounty platform
Traditional Bug bounty platforms for websites and applications, such as HackerOne and BugCrowd, have found success in this old world model. But there is a big difference between the existing "Web 2.0 "bug bounty and the new era of "Web 3.0 "bugs related to blockchains and cryptocurrencies. In the era of decentralized finance (DeFi), the key nature of Web 3.0 bug bounty is that it relates to real monetary value, not just software bugs.
What is a Immunefi?
Immunefi launched in December 2020 to provide smart contract security through Bug bounties. What's more, they already claim to be the premier bug bounty platform in the world! Immunefi had ambitions to contain the DeFi hacking problem. To that end, it provides consulting services, vulnerability detection, project management, and most importantly, an army of white-hat hackers for blockchain projects. Immunefi sought to link the DeFi protocol with hackers to protect platform and user assets.
What is a Bug bounty?
Bug bounty programs offer rewards to security researchers who find potential vulnerabilities in smart contracts and applications. In addition, the bounty incentivises white hat hackers to find and report vulnerabilities to the program, which pays them based on the severity of the vulnerability.
The dilemma of traditional bug bounties
1. Financial incentives
Although the world is divided into white hat hackers and traditional hackers, most people operate in a gray area. For example: there is a hacker who discovers a bug that can make $5 million quickly, who is himself in an ethical dilemma in the face of huge profits. Does he do the right thing and negotiate with a buggy platform in exchange for a $5,000 bug bounty? Or did he take action on the bug himself? Without a consistent and fair reward system for white hats, the temptation of the dark side of human nature will always exist.
2. Report
Defi projects typically have no one responsible for handling bug bounty events. So if a white hat tries to report a bug, try to find the decision maker. In addition, if Ctos receive a risk alert from the outside that their code is flawed, their egos can easily prevail and bounty hunters won't please them. There is no guarantee that the company will be rewarded even if the entire process of finding a bug is reported through the appropriate channels. The finance department may also disagree with the development team about the value of the bug bounty, and the process can lead to a series of dead ends.
Immunefi's bounty program
The Immunefi platform handles/communicates and negotiates on behalf of their white hat and project teams, which greatly improves efficiency and reduces time costs for both parties. Immunefi keeps hackers anonymous and does not require KYC files.
The Immunefi platform has already released some lucrative rewards, with customer Astroport offering up to $3 million. Other notable bounties came from Celer, valued at up to $200,000, xDAI at up to $2 million, and Sushi's $1.25 million bounty.
Immunefi, which currently has a $71 million bounty on its hands, wants to turn bug hunting from a hobby into a viable career. So far, the platform has paid out more than $10 million and saved clients $20 billion in losses.
How do I activate the bounty program?
After customers fill out the Immunefi Bug bounty registry, they receive a questionnaire
Immunefi began drafting a bug bounty program based on the answers to these questions, which was then sent to the client for review, and when the modifications were complete, the program was turned over to Immunefi's operations experts. The operations specialist works with the project team to determine the launch date of the bounty campaign and the pr/marketing details of the bounty as well as how fees and disbursements will be made.
There is no upfront cost to release a bug bounty on Immunefi. When a hacker discovers a real vulnerability, the client only pays Immunefi a 10% performance fee on top of the bug bounty.
Due to the rapid growth of the DEFI space, the resulting security issues have cost most platforms and user funds, which may explain why Immunefi, one of DEFi's emerging bug bounty and security services platforms, has been able to capture value quickly and has raised $5.5 million in funding to date, Led by Electric Capital, Also participating are Blueprint Forest, Framework Ventures, Bitscale Capital, P2P Capital, IDEO Colab, The LAO, BR Capital, 3rd Prime Ventures, North Island Ventures and other individual investors.
Speaking to TechCrunch, Amador added: "The reality is that Web 3 is a much more adversarial environment, which means that every part of the bug bounty process is different from before, from the submission and processing of reports, to the verification of reports, to the negotiation of payments. While the traditional Web 2 bug bounty is a convenient bug-fixing tool, our Web 3 bug bounty is an even more critical contingency system for the DeFi project.
As DeFi's ecological building blocks continue to grow, security has always been a sword of Damocles hanging overhead, and DeFi hacking still won't stop and will continue to happen in the future, needless to say.
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
Related Articles
