Partnered With:

Stop copying Compound's code

Read this article in 8 Minutes

If something goes wrong, neither Compound nor the auditing company will take responsibility for you, and may even think you deserve it!

Original title: "Don't copy the code of Compound"

Original author: Jackson[ 1]

I saw Compound some time ago[2] found two vulnerabilities that could affect the security of funds.

Vulnerability 1

Discovered a serious vulnerability in Compound[3]

The main reason for this vulnerability is the The algorithm of the net value of the fund pool can be attacked. When the share of the fund pool is small, the attacker can maliciously transfer a certain amount of funds to cause the net value to reach a maximum value, so that when depositing funds later, share = fund / share, after divisibility The result is 0, which means that the user does not get a share of the funds deposited! The attacker can then withdraw the shares, stealing the user's funds.

The conditions for exploiting this vulnerability are relatively harsh. Basically, it is only possible to attack when creating a fund pool. However, for extremely critical things such as contracts , should be treated rigorously, and should not be ignored just because it is difficult to exploit, especially since it is very simple to plug this loophole.

So I sent an email to Compound's bug bounty program mailbox to inform about this problem, but have not received a reply so far.

Worried that the email was not received, I contacted CertiK again, hoping to contact Compound through them, but when CertiK said that they already knew about this vulnerability, and did not It is said that this loophole is difficult to exploit and can be circumvented through operational means. Thinking about it is indeed the case. Although this loophole may be exploited, it is difficult to be exploited, so there is no need to make a fuss.

Vulnerability 2

Second serious vulnerability found in Compound[4]

This vulnerability is familiar, the basic logic is callback , re-entrancy, but the vulnerability is indeed more serious than the first one, and it is also easier to be exploited. As long as there is a Token with a hook, it can be attacked!

So I contacted CertiK for the first time, and their reply was still that they had discovered this vulnerability!

I don't quite understand this time, the consequences are so serious, and the loopholes that are relatively easy to be exploited, why can they still exist after being discovered by everyone? And to plug this loophole, you only need to change the order of the two lines of code. Such a simple thing that can solve a big problem, but no one does it? Is it just because Compound doesn't have a token with a hook?

This makes me doubt my perception of the vulnerability! Not long after I posted this vulnerability on this site for the first time, I felt that the content was sensitive, so I deleted the main content.

The vulnerability was finally exploited

However, the vulnerability was still exploited. March-15-2022 06:28:40 PM +8 UTC, Hundred Finance was attacked, and the hackers made a profit of 2363 ETH, with a total value of more than 40 million RMB. The Hundred Finance code is derived from Compound. The exploited vulnerability is the same as the second idea above. In fact, hackers can be more ruthless, and call exitMarket() to exit the loan market at the same time when attacking, so that when the attacker redeems or borrows, all arrears will be ignored!

Reflection

Through reading the Compound code during this period, and communicating about vulnerabilities The process surprised me, their attitude towards loopholes was so indifferent! What caused this situation, and how did Compound and the auditing company consider it? No way of knowing.

This may be the main reason why there will be an attack in the currency circle in a few days!

The code is someone else's, but after copying it, the loopholes need to be borne by ourselves. In this situation, what we can do is to treat our own projects rigorously And the code, because if something goes wrong, neither Compound nor the audit company will be responsible for you, and you may still think you deserve it!

References

[1]jackson : https://learnblockchain.cn/people/245

[2 ]Compound: https://learnblockchain.cn/article/3167

[3] Found a serious loophole in Compound | Denglian Community | Explain blockchain technology in simple terms: https://learnblockchain .cn/article/3591

[4] Discovered the second serious vulnerability of Compound| Denglian Community| Simple explanation of blockchain technology: https://learnblockchain.cn/article/3724