Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DeFi protocol BadgerDAO exploited for $120M in front-end attack

theblockcrypto.com

Post reply on HN
Print view View original

11–20 of 151 posts

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#11

Post by pjc50 »

throwaway248329 wrote: post #6
rvz wrote: post #2

Another day another DeFi project rekt. What happened: > The front end to the BadgerDAO website was reportedly acccessed, according to comments in the project's Discord channel, and used to intercept transactions. One admin said it appears that an API key for Cloudflare was compromised. > One user had around 900 bitcoin ($50.8 million) worth of tokens stolen in a single transaction. Another lost $5 million worth of to…

Regulations in DeFi would do nothing but turning it into traditional, permissioned finance but on blockchain. Nobody wants that.

Nobody wants to lose all their money because the frontend got hacked, and yet here we are.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#12

Post by throwaway248329 »

pjc50 wrote: post #11
throwaway248329 wrote: post #6

Earlier quoted context omitted.

Regulations in DeFi would do nothing but turning it into traditional, permissioned finance but on blockchain. Nobody wants that.

Nobody wants to lose all their money because the frontend got hacked, and yet here we are.

Nobody forces you to put your money in DeFi protocols.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#13

Post by gitfan86 »

rvz wrote: post #2

Another day another DeFi project rekt. What happened: > The front end to the BadgerDAO website was reportedly acccessed, according to comments in the project's Discord channel, and used to intercept transactions. One admin said it appears that an API key for Cloudflare was compromised. > One user had around 900 bitcoin ($50.8 million) worth of tokens stolen in a single transaction. Another lost $5 million worth of to…

In general it takes years of education and years of real world experience to understand that almost 100% of code is going to have a bug or unintended functionality at some point.

The alternative is to learn this lesson the hard way, like these people have.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#15

Post by deweller »

It is important to note that this was not a smart contract exploit. The point of failure here was the website UI. Users were sent to a malicious website due to a stolen Cloudflare API key.

What can DAOs do to prevent the single point of failure that is the web front end? Is there a reliable second level of security to ensure you are at the site you intended? The SSL certificate didn't work because Cloudflare was still terminating the SSL connection.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#16

Post by MauranKilom »

throwaway248329 wrote: post #12
pjc50 wrote: post #11

Earlier quoted context omitted.

Nobody wants to lose all their money because the frontend got hacked, and yet here we are.

Nobody forces you to put your money in DeFi protocols.

That's a non-argument. Nobody forces me to buy baby milk. Yet it makes perfect sense for the FDA to regulate what is allowed to be in baby milk.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#17

Post by throwaway248329 »

deweller wrote: post #15

It is important to note that this was not a smart contract exploit. The point of failure here was the website UI. Users were sent to a malicious website due to a stolen Cloudflare API key. What can DAOs do to prevent the single point of failure that is the web front end? Is there a reliable second level of security to ensure you are at the site you intended? The SSL certificate didn't work because Cloudflare was stil…

Not DAOs, but users can examine the transaction that they are prompted to sign and make sure that it is interacting with the right smart contract.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#18

Post by codethief »

bagpuss wrote: post #5
pjc50 wrote: post #3

Reminder that every DAO is a self-administering bug bounty for all of the value under its control. Reminder also that you don't have to "hack etherum"; there are plenty of spots more vulnerable than the blockchain itself at which value can be stolen. (I would however be interested to know where all this stolen value ends up, and how well it can ultimately be laundered into the real world, or if this is more like driv…

Stolen ETH goes here to get a shave and a new suit, then it can go wherever it likes https://tornado.cash/

Could someone ELI5 how Tornado Cash achieves (or doesn't achieve) privacy? Their FAQ say:

> Is it possible to compromise the protocol and find out information about depositors? -- No, Tornado Cash is a decentralized protocol based on zero knowledge proofs. Its smart contracts are immutable, have no admins, and the proofs are based on strong cryptography. Only the user possessing the Note is able to link deposit and withdrawal.

That very much sounds like an impossibility statement like "Use Tornado Cash and no one will be able to trace your transaction".

OTOH, they also say that

> After depositing, users should wait some amount of time before withdrawing to improve their privacy.

and that

> To preserve privacy a relayer can be used to withdraw to an address with no ETH balance.

So it seems privacy is not a binary switch here and, instead, it can be "improved" and "preserved". But what is it then? Can deposit and withdrawal be linked or not? Are the privacy guarantees as absolute and strong as the FAQ make them out to be?

Post reply on HN