Just remember - code is law. No takesies-backsies :)
If they didn't use a centralized service like Cloudflare, this might not even have happened, lol.
DeFi protocol BadgerDAO exploited for $120M in front-end attack
31–40 of 151 posts
Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack
#32> all smart contracts have been paused to prevent further withdrawals I'm curious — how do you just "pause a smart contract"? Is that written into the code?
I'd think so, yes.
https://ethereum-blockchain-developer.com/022-pausing-destro...
Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack
#33Earlier quoted context omitted.
Stolen ETH goes here to get a shave and a new suit, then it can go wherever it likes https://tornado.cash/
Could someone ELI5 how Tornado Cash achieves (or doesn't achieve) privacy? Their FAQ say: > Is it possible to compromise the protocol and find out information about depositors? -- No, Tornado Cash is a decentralized protocol based on zero knowledge proofs. Its smart contracts are immutable, have no admins, and the proofs are based on strong cryptography. Only the user possessing the Note is able to link deposit and w…
It's a coin mixer: you deposit ETH into a common pool shared with a bunch of other people, and you get back (off-chain) a code that can be used to redeem your deposit at a later date. Since there is no link between the code and the sender on-chain, nobody knows which contributor to the pool withdrew.
So if there are N deposits then later N withdrawals, the only thing you know is that each withdrawal matches one of the deposits, but not which one.
As for privacy improvements:
- If you deposit then immediately withdraw, observers might suspect that you instantly withdrew your deposit.
- You need ETH for the withdrawal transaction, which has to come from somewhere (making it potentially traceable). With their relayers you can withdraw to an empty account while hiding the origin of the transaction fee.
Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack
#34It is important to note that this was not a smart contract exploit. The point of failure here was the website UI. Users were sent to a malicious website due to a stolen Cloudflare API key. What can DAOs do to prevent the single point of failure that is the web front end? Is there a reliable second level of security to ensure you are at the site you intended? The SSL certificate didn't work because Cloudflare was stil…
This is effectively a supply chain attack. To defend against it you need to secure the supply chain all the way from build to deployment.
So a quick solution would be to run a job that checks your site every minute or so and compares the javascript against known hash values. Shut the site down if a hash has changed.
Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack
#35Reminder that every DAO is a self-administering bug bounty for all of the value under its control. Reminder also that you don't have to "hack etherum"; there are plenty of spots more vulnerable than the blockchain itself at which value can be stolen. (I would however be interested to know where all this stolen value ends up, and how well it can ultimately be laundered into the real world, or if this is more like driv…
Stolen ETH goes here to get a shave and a new suit, then it can go wherever it likes https://tornado.cash/
I don't understand how these mixer services work with regards to law enforcement. Wouldn't the any outputs of such laundering services be considered dirty to begin with, regardless of whether or not the supposed inputs were clean originally?
If anything, I'd expect the output of such a service to be even worse than most inputs, as the money will be mixed with all the inputs, some of which would be associated with horrible crime beyond just fraud or theft.
Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack
#36It is important to note that this was not a smart contract exploit. The point of failure here was the website UI. Users were sent to a malicious website due to a stolen Cloudflare API key. What can DAOs do to prevent the single point of failure that is the web front end? Is there a reliable second level of security to ensure you are at the site you intended? The SSL certificate didn't work because Cloudflare was stil…
Not DAOs, but users can examine the transaction that they are prompted to sign and make sure that it is interacting with the right smart contract.
That technically just moves the problem one step further. How are users supposed to learn what is the right smart contract to begin with?
Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack
#37Earlier quoted context omitted.
Regulations in DeFi would do nothing but turning it into traditional, permissioned finance but on blockchain. Nobody wants that.
I think that's the point. Regulations on finance are, in part, to avoid attacks, scams, misunderstandings... Blockchains only offer some security in a part of the transaction, but they do nothing for the "real world" part. If you want serious finance that people can rely on you'll end up looking like traditional, permissioned finance but on blockchain.
If you have regulations you'll realize that they're mostly sufficient to secure transactions as well, at which point the blockchain becomes unnecessary as well.
Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack
#38Earlier quoted context omitted.
Could someone ELI5 how Tornado Cash achieves (or doesn't achieve) privacy? Their FAQ say: > Is it possible to compromise the protocol and find out information about depositors? -- No, Tornado Cash is a decentralized protocol based on zero knowledge proofs. Its smart contracts are immutable, have no admins, and the proofs are based on strong cryptography. Only the user possessing the Note is able to link deposit and w…
If you put 123ETH into Tornado from address A and then withdraw 123ETH shortly after from Tornado to address B this will be written to the blockchain. It might not be evidence that A and B are your addresses, but strong implications. So, you put it into Tornado and wait days, weeks, or even months, so it could be a random transaction.
I wonder what would be a legitimate, non-suspicious reason to interact with such a service at all?
Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack
#39Earlier quoted context omitted.
If you put 123ETH into Tornado from address A and then withdraw 123ETH shortly after from Tornado to address B this will be written to the blockchain. It might not be evidence that A and B are your addresses, but strong implications. So, you put it into Tornado and wait days, weeks, or even months, so it could be a random transaction.
I wonder what would be a legitimate, non-suspicious reason to interact with such a service at all?
There are entirely legal, legitimate things one might do while still wanting to have some privacy about it. Buying porn, for example, might be something you're fine with but not really want tied to your known address.
Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack
#40Another day another DeFi project rekt. What happened: > The front end to the BadgerDAO website was reportedly acccessed, according to comments in the project's Discord channel, and used to intercept transactions. One admin said it appears that an API key for Cloudflare was compromised. > One user had around 900 bitcoin ($50.8 million) worth of tokens stolen in a single transaction. Another lost $5 million worth of to…
Or just put in what you can afford to loose. No hand holding from regulators needed.
"The future of finance" or "so unsafe you should only put play money in". Pick one.