DeFi protocol BadgerDAO exploited for $120M in front-end attack

#1

Post by gzer0 » Thu, Dec 02, 2021, 10:56 AM UTC

DeFi protocol BadgerDAO exploited for $120M in front-end attack
theblockcrypto.com

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#2

Post by rvz » Thu, Dec 02, 2021, 11:34 AM UTC

Another day another DeFi project rekt. What happened:

   > The front end to the BadgerDAO website was reportedly acccessed, according to comments in the project's Discord channel, and used to intercept transactions. One admin said it appears that an API key for Cloudflare was compromised.

   > One user had around 900 bitcoin ($50.8 million) worth of tokens stolen in a single transaction. Another lost $5 million worth of tokens in one go.

Once that BTC is gone, it is gone. DAOs seem to have a lot of trust issues beyond a simple front-end attack and not even you should trust that they can keep their own websites secure. Where are the regulations, audits and security checks for this thing?

Oh dear.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#3

Post by pjc50 » Thu, Dec 02, 2021, 11:38 AM UTC

Reminder that every DAO is a self-administering bug bounty for all of the value under its control.

Reminder also that you don't have to "hack etherum"; there are plenty of spots more vulnerable than the blockchain itself at which value can be stolen.

(I would however be interested to know where all this stolen value ends up, and how well it can ultimately be laundered into the real world, or if this is more like driving a truck into an ATM that causes far more loss than is actually successfully stolen)

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#4

Post by fergie » Thu, Dec 02, 2021, 11:48 AM UTC

It says a lot that these articles are always quantified in dollars.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#5

Post by bagpuss » Thu, Dec 02, 2021, 11:55 AM UTC

pjc50 wrote: post #3

Reminder that every DAO is a self-administering bug bounty for all of the value under its control. Reminder also that you don't have to "hack etherum"; there are plenty of spots more vulnerable than the blockchain itself at which value can be stolen. (I would however be interested to know where all this stolen value ends up, and how well it can ultimately be laundered into the real world, or if this is more like driv…

Stolen ETH goes here to get a shave and a new suit, then it can go wherever it likes

https://tornado.cash/

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#6

Post by throwaway248329 » Thu, Dec 02, 2021, 11:57 AM UTC

rvz wrote: post #2

Another day another DeFi project rekt. What happened: > The front end to the BadgerDAO website was reportedly acccessed, according to comments in the project's Discord channel, and used to intercept transactions. One admin said it appears that an API key for Cloudflare was compromised. > One user had around 900 bitcoin ($50.8 million) worth of tokens stolen in a single transaction. Another lost $5 million worth of to…

Regulations in DeFi would do nothing but turning it into traditional, permissioned finance but on blockchain. Nobody wants that.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#7

Post by hungryforcodes » Thu, Dec 02, 2021, 11:58 AM UTC

rvz wrote: post #2

Another day another DeFi project rekt. What happened: > The front end to the BadgerDAO website was reportedly acccessed, according to comments in the project's Discord channel, and used to intercept transactions. One admin said it appears that an API key for Cloudflare was compromised. > One user had around 900 bitcoin ($50.8 million) worth of tokens stolen in a single transaction. Another lost $5 million worth of to…

Or just put in what you can afford to loose. No hand holding from regulators needed.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#8

Post by Manfred » Thu, Dec 02, 2021, 11:58 AM UTC

Reading guide:

DeFi: Decentralized Finance

DOA: decentralized autonomous organization; an organization represented by rules encoded as a computer program that is transparent

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#9

Post by tpxl » Thu, Dec 02, 2021, 11:58 AM UTC

rvz wrote: post #2

Another day another DeFi project rekt. What happened: > The front end to the BadgerDAO website was reportedly acccessed, according to comments in the project's Discord channel, and used to intercept transactions. One admin said it appears that an API key for Cloudflare was compromised. > One user had around 900 bitcoin ($50.8 million) worth of tokens stolen in a single transaction. Another lost $5 million worth of to…

> Where are the regulations, audits and security checks for this thing?

Missing by design. It is telling that a currency dubbed "USD tether" which (let's pretend) is backed by USD 1:1 magically excuses you from all regulations you need to abide by if you process actual USD.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#10

Post by astrange » Thu, Dec 02, 2021, 12:04 PM UTC

Manfred wrote: post #8

Reading guide: DeFi: Decentralized Finance DOA: decentralized autonomous organization; an organization represented by rules encoded as a computer program that is transparent

Of course, it may be decentralized but many projects advertise it as "distributed computing" which it isn't. Since every node has to do the same calculations, it's only as fast as a single computer.

It's great at instantly losing all your money to a teenage hacker though.