A hacker who gambled $3 million that a decentralized finance (DeFi) protocol was exploitable hit the jackpot over the weekend, coming away with a tidy $12.6 million profit.
While cryptocurrency hacks — and especially DeFi hacks — are nothing new, and a $15.6 million loss is barely worth mentioning — DeFi bridge protocol Ronin Network was hit for a record $625 million last week — this one had a number of novel, and very worrisome, aspects.
See also: In $625M Hack, a Bigger Crypto Security Problem Is on Display
Most notably, this exploit was a real gamble. If it failed, the crook would have lost $3 million worth of ether.
Then there’s another hit at DeFi’s security, and more broadly at the potential for the crypto market manipulation that the Securities and Exchange Commission (SEC) says is rampant in finance’s “Wild West.”
Read more: Gensler Says SEC Is Coming for Crypto Exchanges
In the case of Inverse Finance’s Anchor money market, an oracle — a “trusted” source of information that autonomous DeFi projects’ self-executing smart contracts use to pay out on agreements — was tricked into thinking that Inverse’s native INV cryptocurrency was worth far more than it really was.
That allowed the fraudster to take out far larger loans of ether, wrapped bitcoin, the DOLA stablecoin and Yearn.Finance’s YFI token than the collateral justified. That ETH was quickly sold for a large profit — $15.6 million — while the collateral was abandoned.
Along the way, the thief exploited DeFi’s key strength — and biggest weakness: its lack of any central management.
First, there was the fact that the attack relied on the anonymity of mixing services. Second, there was the market manipulation possible on decentralized exchanges (DEXs). Third, there was the sometimes-misplaced trust of information sourced by oracles. And fourth, there was the lack of anyone for harmed investors to sue.
Mixing It Up
While most hacks end with the crook sending ill-gotten crypto to a mixing service to hide its provenance and make off-ramping the funds far less detectable, the Inverse Finance exploit began at one.
The person behind the attack started by withdrawing $3 million worth of ether from Tornado Cash, a well-known Ethereum service that mixes multiple users’ cryptocurrencies. This obscures their origin, putting up a big roadblock for law enforcement agencies and blockchain intelligence firms’ increasingly sophisticated capabilities when it comes to tracing cryptocurrency to an actual human criminal.
Read more: When Privacy Counts, Crypto Users Turn to Mixing Services
Tornado cash is itself a DeFi project run by an autonomous, smart-contract-controlled decentralized autonomous organization (DAO), so there’s no way — at least without a lot of luck and painstaking work — to see where the funds came from.
Of course, both the Bank for International Settlements (BIS) and the U.S. Justice Department (DOJ) have said that DeFi projects aren’t as decentralized as they claim to be, given that developers and large token holders (who can vote on changing DAOs’ rules) often exercise outsize influence on them.
See more: Bank for International Settlements Calls DeFi’s Decentralization an Illusion
Wild, Wild West
One of the reasons the SEC has steadfastly refused to follow many other countries’ decision to license bitcoin exchange traded funds (ETFs) is the potential for market manipulation by “whales” who have enough crypto holdings to move markets without exposing their identities.
In this case, the Inverse Finance attacker used millions of dollars in ether to fund a flurry of transactions on SushiSwap, a top decentralized exchange, that made it look like the price of INV was skyrocketing.
That tricked the oracle running the SushiSwap INV/ETH trading pair oracle — the bug exploit — into marking up the value of INV, which was quickly moved over to Anchor. The risk was that arbitrageurs would correct the price before the loans could be taken out and the profits run back through Tornado Cash.
The SEC has approved ETFs for bitcoin futures but not spot-traded ETFs that let investors get exposure to the cryptocurrency without needing to buy and hold it personally.
Without the surveillance sharing agreement with another regulated market available to bitcoin derivatives, the SEC has given numerous rejections over the past few months. An exchange would have to “establish that the underlying market inherently possesses a unique resistance to manipulation beyond the protections that are utilized by traditional commodity or securities markets,” the SEC said in January after it refused to allow the asset management firm Arca to launch a spot bitcoin exchange on the New York Stock Exchange. “No listing exchange has satisfied its burden to make such demonstration.”
Blind as an Oracle
Blockchain oracles are supposed to be neutral and reliable providers of information feeds.
Well known meteorology firm AccuWeather set itself up as a weather oracle, allowing blockchain InsurTech firms to offer crop insurance that pays out to farmers automatically based on weather information.
Read more: DeFi’s Self-Executing Payouts Enable Crop Insurance for Small Farmers in Africa
The problem is that smart contracts can actually be very stupid. If not worded and programed carefully, the results can be inappropriate payouts or even contracts being unable to pay out the funds locked in them.
See more: What Is a Smart Contract?
In this case, the SushiSwap oracle — which is run by its own smart contract — couldn’t detect the manipulation and allowed information to go through to the smart contract-controlled lending protocol that relied on it, according to blockchain security firm PeckShield.
Gambling on Goodwill
While Inverse Finance, which calls itself a “decentralized global central bank” said that a governance proposal “to ensure all wallets impacted by the price manipulation are repaid 100%,” there’s no guarantee that the project’s governance token holders will agree.
1. The plan to be proposed to governance is to ensure all wallets impacted by the price manipulation are repaid 100%. We have multiple avenues for accomplishing this and will provide updates as the DAO discusses our options.
— Inverse+ (@InverseFinance) April 2, 2022
That’s what happened to MakerDAO lending protocol borrowers when a bug caused more than $8 million in collateral to be sold off for next to nothing. After an initial vote to compensate the victims, big token holders voted no as it would cut into the value of their holdings.
That lack of a decentralized governance body to be sued that DeFi claims as a strength is about to be tested, however, as those MakerDAO victims are trying to sue.
Read more: PoolTogether Lawsuit Will Test Whether DeFi Really Is Decentralized
That’s probably why the Inverse Finance Twitter thread revealing the loss also said, “We have multiple avenues for accomplishing this and will provide updates as the DAO discusses our options … There is no plan or need to mint additional INV as part of the process to repay wallet holders.”
We’re always on the lookout for opportunities to partner with innovators and disruptors.
Learn More