Author: Luccy, Kaori, BlockBeats

Editor: Jack, BlockBeats

On September 20th, Balancer suffered a loss of $238,000 in a new round of attacks. SlowMist Intelligence Analysis believes that this was a BGPHijacking attack, and accessing the wallet through the website link may result in a phishing attack.

BGPHijacking, also known as BGP route hijacking, is a type of front-end attack. In BGPHijacking attacks, attackers send false BGP route update information to redirect traffic in the wrong direction, allowing for eavesdropping, tampering, or interruption of traffic. In simple terms, a website can send spam emails to approve transactions, allowing malicious contracts to transfer all of a user's funds.

This is also the biggest difference from previous attack incidents - the attack targeted the Balancer front-end.

OpCo, Orb Collective, and the cost of strategic transformation

It is worth noting that before this attack, Balancer had another important news. On April 14th, Balancer's service provider, Balancer OpCo, announced that it had fired two engineers and reduced its operating budget.

Balancer OpCo is a wholly-owned subsidiary of the Balancer Foundation, providing management and operational services, as well as front-end development and engineering workflows for Balancer. From August of last year to June of this year, seven proposals involving Balancer OpCo were presented in the Balancer DAO, with five of them showing approval. In addition to team financing, 250,000 BAL tokens were transferred to OpCo so that it could focus on private token sales. Currently, a proposal for fundraising for the platform's next year of operation is also in the preliminary discussion stage.

However, as the protocol shifted its focus towards improving user interface and marketing, the number of Balancer OpCo personnel decreased. To address this, Balancer will establish a dedicated marketing team called Orb Collective, responsible for discussing mechanisms for Balancer to collaborate with platform users, promoting the development of the Balancer protocol through partnership, marketing, integration, design, and personnel operations, in order to expand the global adoption of the Balancer protocol. In August of last year, Orb Collective was officially launched, and the team stated that new promotion strategies will also utilize "native crypto Twitter voice".

It is worth noting that in April of this year, Balancer governance updated the financial plan of Orb Collective in the proposal to renew Certora's smart contract audit contract, which will be allocated from Orb Collective's budget to OpCo starting from the second quarter of 2023 to ensure the safety of Balancer users' funds. However, nearly 80% of Balancer DAO community members rejected the proposal for Balancer OpCo Limited to conduct smart contract audits, which was the only proposal rejected among the seven proposals.

In the same month, Coindesk published an article titled "DeFi protocol Balancer cuts budget and headcount ahead of strategic pivot", stating that Balancer will make strategic adjustments. According to the article, the Balancer OpCo team revealed in a Discord conference call in April of this year with more than 20 participants that the company had laid off two engineers and reduced operating budgets.

Orb Collective CEO Jeremy Musighi said, "We have developed a new vision for the Balancer brand, and we are very excited about it. At the same time, we have been making some adjustments to our marketing team to ensure that we have the right people to execute this new vision." In the third quarter of 2022, the Orb team applied for a $76,000 operating budget to expand Balancer's voice on social media, podcasts, and community relationship maintenance. In the fourth quarter, the budget proposal claimed that due to the bear market cycle, the Orb team's operating budget was only $48,000, almost a 50% decrease.

Meanwhile, the team stated that this was in order to reform their brand strategy and will focus on improving their user interface and marketing in the future. When this news was announced, Balancer faced some market pressure, and perhaps it was this front-end layoff that provided attackers with an alternative opportunity.

This time, Balancer's front-end was attacked, and it's hard not to link it to the failed smart contract audit proposal and the layoff of front-end personnel. Perhaps the strategic shift is false, and the funding shortage during the bear market cycle is true.

Centralized Front-end Hidden Concerns

Aside from reasons within the Balancer team, this attack has also raised concerns within the community regarding the centralization of the front-end in DeFi protocols.

In the development history of DeFi, incidents of losses caused by front-end attacks are not common. In December 2021, a series of malicious codes were injected into the front-end code of the website of decentralized organization Badger DAO, allowing attackers to transfer tokens without the user's knowledge. In May 2022, the front-end of Cronos ecosystem DEX MM.Finance was attacked, and hackers exploited DNS vulnerabilities to steal over $2 million in assets from users.

The last large-scale discussion about decentralized front-end was due to Tornado Cash being sanctioned and its front-end being blocked. However, front-end still faces security pressures. Some people believe that ENS may be a solution to front-end attacks, but ENS domain resolution is "centralized", so it is not very realistic to use it to resist "attacks on decentralization".

Although DeFi contracts are theoretically immutable and irreversible once deployed, and should not be subject to human intervention, the vast majority of front-ends are still implemented through traditional architecture. While web pages themselves are constantly evolving and developing, there are many potential threats in areas such as domain names, network services, servers, storage services, etc. Attacks on the front-end are often overlooked by developers.

As a DeFi OG, Balancer is now also under attack from the front end, and as a result, there has been a call from the community to build a decentralized front end. However, such voices are not too many, and compared to the heat generated by the front ends of Uniswap and Tornado Cash being blocked, the encryption industry still needs to explore what ordinary users need to do in response to front-end hacker attacks.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia