This site uses cookies. Browsing the site, you agree to the use of cookies. If you need more information, please visit the Cookies Policy page
Cryptocurrencies: 4264 / Markets: 35406
Market Cap: $ 1 563 383 512 782 / 24h Vol: $ 100 850 779 506 / BTC Dominance: 60.401379181427%

Н News

Finance Redefined: One hack to bring down a whole market, Feb 10–17

840_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjEtMDIvMzI0Y2Y3MWItZmUwYS00MzI3LTljNzYtYTFiYzM5ZjQ0NDIxLmpwZw==.jpg

The Alpha Homora hack is still rippling through markets.

Finance Redefined is Cointelegraph's DeFi-centric newsletter, delivered to subscribers every Wednesday.

The Alpha Homora and Cream Finance hack has made a gigantic mark in the DeFi space this week.

It is the largest single hack in DeFi history at $37 million in funds stolen. It is also one of the most complex, apparently leveraging several honest-to-God vulnerabilities in Alpha Homora. A few missing input checks in very specialized conditions allowed the hacker to abuse Alpha Homora’s privilege of borrowing an unlimited amount of funds from Cream Finance’s Iron Bank. Flash loans were of course involved, but unlike some previous hacks like Harvest Finance, this doesn’t seem to have been a purely economic exploit.

News of the hack had a very negative impact on prices for all the protocols involved in the hack, including Aave for some reason. Looking more generally at the DeFi Perp on FTX, there is a clear peak right on Feb. 13 when the hack happened.

ad4d4ee9-1e77-49b3-9cb9-3511cac454e8.pngFTX’s DeFi index, courtesy of TradingView.

Perhaps some of that is just normal market action, but overall it’s looking as if the hack single-handedly put an end to the DeFi season, for now.

Auditors feeling the heat

As any protocol reaching any kind of mass adoption today, Alpha Homora was audited by Quantstamp and PeckShield, both of them skilled and respectable firms.

Yet, the details of the hack led some to suspect it was an inside job, potentially by someone at these auditing firms. Yearn.finance core developer Banteg mentioned how the details of the hack were so obscure that it was extremely unlikely anyone figured it out just by looking at the contracts. Notably, the pool attacked by the hacker was unannounced and unused, which is what allowed the hack to occur in the first place.

While there were no public accusations, the incident triggered yet another discussion of why auditors failed to catch the bug, whether they are properly incentivized, and how this situation can be mitigated.

The anatomy of a complex hack

As a former bug bounty hunter, I really do believe that the auditing ecosystem is about as “incentive-aligned” as it can be. Auditing companies risk their reputation every time a major bug like this slips through their nets. Enough of these in quick succession and nobody will trust that business anymore. Auditors have all the motivation to find everything they can, it’s just that sometimes they realistically cannot do so.

An audit is a limited-time contract during which a team of experienced security engineers combs through the code in search of anything that looks suspicious. Keywords here are “limited-time” and “in search of anything.”

I can say from personal experience that a bug like the one we had right now is not something you can casually find by looking at the code. Finding a multi-step, complex bug like this is an iterative process. It starts with you stumbling on that one weird thing that’s not acting as it should. For example a website forgetting to check if you’re actually logged in when performing a certain task. You take that nugget and ask yourself, “how can I exploit this?” You come up with ideas, scour the platform for other weak points and see if you can combine them somehow. Most of the time you don’t actually find anything and that weak point remains unexploitable.

But with days of focused work, multiple trials and errors, sometimes you do figure out how to exploit the initial issue. When it happens, it’s always a combination of factors that alone seem irrelevant, but taken together they fit into a nasty puzzle.

The focus and dedication required to find most of the bugs that resulted in major hacks is something that goes beyond the scope of an audit. If they were to chase every single lead with the time they had, they would quite literally waste so much of it that they’d fail to find the easily exploitable and obvious things. Not to say that auditors never find complex bugs, but it’s unreasonable to expect them to find everything. And if an auditor really did find the Alpha Homora bug and withheld it, there are deeper issues at play than economic incentives.

How to secure DeFi

The issues with audits mean that projects should launch bug bounties to find really complex bugs. They have no time limits, many more eyes scouring the platform, and the pay is results-based — much more efficient than paying auditors more work hours in the hope they’d find something.

Most understand the power of bug bounties by now, although of course Alpha Homora did not have one. But projects like Yearn.finance do, and they got hacked all the same.

Sometimes these things just happen. Crypto carries the problematic combo that actually exploiting a bug for money and getting away with it is really easy, while the infrastructure is unlike anything else hackers have seen before. To begin hunting for bounties in DeFi, you have to be a serious crypto expert and an experienced Solidity/Vyper programmer — both things that don’t just come immediately. For a white hat hacker, there are plenty of standard Web2 platforms offering very competitive bounties, why should they bother researching DeFi?

People misunderstand the challenge of securing protocols. Alpha Homora said that any bounty they could have paid would’ve paled in comparison to the loot at stake. But the goal shouldn’t be to pay hackers what they could steal. That’s a losing proposition. The goal is to attract good-hearted white hat hackers to analyze the project and get paid a legal bounty. A bounty that is less than the millions they could get by exploiting the bug, but one that can still be a life-changing payout. Maybe something like $50,000, $200,000, depending on the situation? That’s likely less than the cost of one audit by a highly regarded firm.

In other news

Source

  • 14.09.20 17:35 Анастасия

    Давайте биткоин по 20к

  • 14.09.20 17:40 Лысый Боб

    Подарите книгу)))

  • 14.09.20 17:41 Светлана П

    Hello

  • 14.09.20 17:48 Николаев

    Понеслась

  • 14.09.20 17:53 Щука А

    Слава эфиру

  • 14.09.20 17:58 Захар Трофимов

    Надо изучать Defi , интересно

  • 14.09.20 18:01 Попко Колян

    Давайте биткоин по 20к

  • 14.09.20 18:08 Попков С.А.

    Круто

  • 14.09.20 18:13 Алексей С.

    ​гуд

  • 14.09.20 18:18 Попков С.А.

    Как успехи?

  • 14.09.20 18:24 Попко Колян

    👍👍👍👍👍

  • 14.09.20 18:26 Егор Шетюк

    Понеслась

  • 14.09.20 18:26 Захар Трофимов

    15$. Тюмень рулит😁

  • 14.09.20 18:35 Константин В.В

    Биток и эфир держу до лучших времён)

  • 14.09.20 18:38 Попко Колян

    ​ДОБРОГО

  • 14.09.20 18:43 Даниил

    Рига смотрит

  • 14.09.20 18:46 Вадим Никулин

    Всегда смотрю Вас!

  • 14.09.20 18:55 Захар Трофимов

    Минск на проводе

  • 14.09.20 18:56 Щука А

    Спасибо за ваш труд

  • 14.09.20 19:01 Никита

    Хай

  • 14.09.20 19:06 Вячеслав Левков

    Отложил биток на пенсию

  • 14.09.20 19:13 Попков С.А.

    Отличные эфиры у вас

  • 14.09.20 19:20 Щука А

    Привет из Москвы

  • 14.09.20 19:25 Алексей С.

    Всем РЕСПЕКТ

  • 14.09.20 19:27 Николай

    Вперед криптаны

  • 14.09.20 19:34 КРИПТАН

    Слышно гуд

  • 14.09.20 19:36 Егор Шетюк

    Подарите книгу)))

  • 14.09.20 19:44 Светлана П

    миллионерам привет

  • 14.09.20 19:48 Вячеслав Левков

    Крипта скам=)

  • 14.09.20 19:53 Тоха

    Понеслась

  • 14.09.20 19:57 Носов А.А

    Рига смотрит

  • 14.09.20 20:04 Прокоп

    Донаты принемаете?

  • 14.09.20 20:06 Носов А.А

    спасибо

  • 14.09.20 20:12 Юрий Ник

    Тюмень рулит😁

  • 14.09.20 20:18 Даниил

    миллионерам привет

  • 14.09.20 20:18 Нина

    17$. Биток и эфир держу до лучших времён)

  • 14.09.20 20:24 Никита

    18$. Задонатю вам баблишка)

  • 14.09.20 20:25 Вячеслав Левков

    Поможем парням лайками, я уже свой поставил

  • 14.09.20 20:26 Павел Скоровойтов

    Слава эфиру

  • 14.09.20 20:35 Носов А.А

    Привет, пацаны. Слышно, видно хорошо

  • 14.09.20 20:36 Тоха

    Шалом

  • 14.09.20 20:44 Лена

    Биток и эфир держу до лучших времён)

  • 14.09.20 20:47 Нина

    ​ку-ку)

  • 14.09.20 20:53 Попков С.А.

    Все good. Ростем потихоньку и падаем, как всегда

  • 14.09.20 20:58 Санек

    Всем РЕСПЕКТ

  • 14.09.20 21:01 Славка Орехов

    Спасибо за ваш труд

  • 14.09.20 21:10 Ваня А,

    Привет, пацаны. Слышно, видно хорошо

  • 14.09.20 21:13 Нина

    ​ДОБРОГО

  • 14.09.20 21:20 Никита

    Привет парни!

  • 14.09.20 21:25 Егор Шетюк

    Hello

  • 14.09.20 21:27 Вячеслав Левков

    ​ку-ку)

  • 14.09.20 21:33 Попков С.А.

    Тамбов с вами братва

  • 14.09.20 21:37 Серега Бумер

    Слава эфиру

  • 14.09.20 21:42 Ваня А,

    Подарите книгу)))

  • 14.09.20 21:50 Павел Скоровойтов

    Поможем парням лайками, я уже свой поставил

  • 14.09.20 21:54 Захар Трофимов

    Привет парни!

  • 14.09.20 21:56 Санек

    Отложил биток на пенсию

  • 14.09.20 22:03 Носов А.А

    Привет, пацаны. Слышно, видно хорошо

  • 14.09.20 22:03 Попков С.А.

    14$. Надо изучать Defi , интересно

  • 14.09.20 22:09 Николай

    Поможем парням лайками, я уже свой поставил

  • 14.09.20 22:14 Вадим Никулин

    Я из РБ слежу за вами давно💰

  • 14.09.20 22:17 Николай

    Поможем парням лайками, я уже свой поставил

  • 14.09.20 22:24 Лена

    ​Я снова с вами)))

  • 14.09.20 22:28 Носов А.А

    Отложил биток на пенсию

  • 14.09.20 22:31 Серега Бумер

    Тюмень рулит😁

  • 14.09.20 22:40 Светлана П

    Сморгонь 👍

  • 14.09.20 22:43 Вадим Никулин

    Отложил биток на пенсию

  • 14.09.20 22:46 Николаев

    Круто

  • 14.09.20 22:53 Ваня А,

    Люблю ваши трансляции, вы крутые!

  • 14.09.20 22:58 Вячеслав Левков

    Биток вперед!!!

  • 14.09.20 23:05 Носов А.А

    ​Привет всем с Украины!

  • 14.09.20 23:06 Носов А.А

    12$. ​здарова бандиты

  • 14.09.20 23:09 Константин В.В

    Отложил биток на пенсию

  • 14.09.20 23:14 Прокоп

    Екатеринбург на связи

  • 14.09.20 23:18 Николаев

    Круто

  • 14.09.20 23:25 Тоха

    ​здарова бандиты

  • 14.09.20 23:27 Попков С.А.

    Отличные эфиры у вас

  • 14.09.20 23:33 Лена

    Поможем парням лайками, я уже свой поставил

  • 14.09.20 23:39 Николаев

    Доброе утречко

  • 14.09.20 23:45 Лена

    Как успехи?

  • 14.09.20 23:49 Павел Скоровойтов

    ​ку-ку)

  • 14.09.20 23:51 Ваня А,

    Привет, пацаны. Слышно, видно хорошо

  • 14.09.20 23:57 Попков С.А.

    Хомяки тут

  • 15.09.20 00:01 Лысый Боб

    Привет, пацаны. Слышно, видно хорошо

  • 15.09.20 00:07 Санек

    Слава эфиру

  • 15.09.20 00:12 Щука А

    Екатеринбург на связи

  • 15.09.20 00:14 Нина

    23$. Лайк

  • 15.09.20 00:16 Юрий Ник

    Вперед криптаны

  • 15.09.20 00:25 Лена

    Биток и эфир держу до лучших времён)

  • 15.09.20 00:26 Попков С.А.

    Как успехи?

  • 15.09.20 00:33 Попко Колян

    Я из РБ слежу за вами давно💰

  • 15.09.20 00:40 Даниил

    миллионерам привет

  • 15.09.20 00:50 Константин В.В

    11$. Круто

  • 17.09.20 15:31 Trident

    купил билет на семинар который изначально планировался в субботу.... в пятницу не смогу послушать, гле посмотреть запись?

  • 24.09.20 12:08 Серго1985

    Как бабло зарабатывается??

  • 15.10.20 09:16 Vyacheslav

    отлично зарабатывается !)

  • 15.10.20 09:16 Vyacheslav

    у вас как?

  • 09.02.21 10:40 ave2510

    всем привет! кто то заходил в ю8д...?

  • 10.02.21 12:52 [email protected]

    почему я на юнисвоп не вижу токен NTFI

  • 16.02.21 18:27 Jessikagylu

    Всем привет. А какой интернет вы используете для майнинга? Прочла интересную статью https://hashalot.io/blog/vyjdet-li-majning-za-limit-trafika-kakaya-skorost-interneta-nuzhna-dlya-majninga/ и задумалась над этим. Какие характеристики сети у вашего провайдера?

To join the Chat, you need a free pro-blockchain.com account. Enter Registration