Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DeFi protocol BadgerDAO exploited for $120M in front-end attack

theblockcrypto.com

Post reply on HN
Print view View original

41–50 of 151 posts

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#41

Post by eterm »

Nextgrid wrote: post #37
gjulianm wrote: post #26

Earlier quoted context omitted.

I think that's the point. Regulations on finance are, in part, to avoid attacks, scams, misunderstandings... Blockchains only offer some security in a part of the transaction, but they do nothing for the "real world" part. If you want serious finance that people can rely on you'll end up looking like traditional, permissioned finance but on blockchain.

If you have regulations you'll realize that they're mostly sufficient to secure transactions as well, at which point the blockchain becomes unnecessary as well.

Not just secure them, but regulations and laws allow or require them to be overturned and reversed.

At which point the blockchain becomes a hiderance.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#42

Post by Kbelicius »

throwaway248329 wrote: post #28
MauranKilom wrote: post #16

Earlier quoted context omitted.

That's a non-argument. Nobody forces me to buy baby milk. Yet it makes perfect sense for the FDA to regulate what is allowed to be in baby milk.

Baby milk is a disingenuous analogy since it's not expected to be consumed by the buyer. If consenting adults voluntarily went out of their way to get an unregulated product, without harming anyone but themselves, then why should they be stopped?

> Baby milk is a disingenuous analogy since it's not expected to be consumed by the buyer.

This is a disingenuous argument. FDA doesn't regulate only stuff that is not expected to be consumed by the buyer. GP could have said wine instead of baby milk.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#43

Post by k__ »

Nextgrid wrote: post #38
k__ wrote: post #30

Earlier quoted context omitted.

If you put 123ETH into Tornado from address A and then withdraw 123ETH shortly after from Tornado to address B this will be written to the blockchain. It might not be evidence that A and B are your addresses, but strong implications. So, you put it into Tornado and wait days, weeks, or even months, so it could be a random transaction.

I wonder what would be a legitimate, non-suspicious reason to interact with such a service at all?

All transactions are public.

People can simply crawl the blockchain for addresses that have a good amount of money and then check which of them they can relate to persons.

If they know you and how much your crypto net worth is, they might start to attack you in some kind of way to get your private key.

If you tornadoed that money in an address that can't be linked to other addresses anymore, the work to relate the address to you might be too big so people won't try.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#44

Post by VoodooJuJu »

rvz wrote: post #2

Another day another DeFi project rekt. What happened: > The front end to the BadgerDAO website was reportedly acccessed, according to comments in the project's Discord channel, and used to intercept transactions. One admin said it appears that an API key for Cloudflare was compromised. > One user had around 900 bitcoin ($50.8 million) worth of tokens stolen in a single transaction. Another lost $5 million worth of to…

900 bitcoin. Just sitting there in some fragile little exchange, or whatever this DAO is. If these people are so rich, why aren't they so smart?

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#45

Post by throwaway248329 »

Nextgrid wrote: post #36
throwaway248329 wrote: post #17

Earlier quoted context omitted.

Not DAOs, but users can examine the transaction that they are prompted to sign and make sure that it is interacting with the right smart contract.

That technically just moves the problem one step further. How are users supposed to learn what is the right smart contract to begin with?

Smart contracts are immutable, so realistically, once you know which one is the right one you can just bookmark it.

If you don't want to trust anyone at all, you can read the contract code and make individual judgement whether it does what it's supposed to do.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#46

Post by root_axis »

By default, whenever such hacks occur, I suspect the project creators are in on it unless proven otherwise. When you're talking about multi million dollar payloads that can be stolen without scrutiny from law enforcement, the incentive to abscond is huge.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#47

Post by Grustaf »

Nextgrid wrote: post #35
bagpuss wrote: post #5

Earlier quoted context omitted.

Stolen ETH goes here to get a shave and a new suit, then it can go wherever it likes https://tornado.cash/

I don't understand how these mixer services work with regards to law enforcement. Wouldn't the any outputs of such laundering services be considered dirty to begin with, regardless of whether or not the supposed inputs were clean originally? If anything, I'd expect the output of such a service to be even worse than most inputs, as the money will be mixed with all the inputs, some of which would be associated with hor…

Isn't that a bit like saying cash is dirty? I don't think we are under obligation to keep our funds traceable? Perhaps we are getting closer to that point though.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#48

Post by throwaway248329 »

Kbelicius wrote: post #42
throwaway248329 wrote: post #28

Earlier quoted context omitted.

Baby milk is a disingenuous analogy since it's not expected to be consumed by the buyer. If consenting adults voluntarily went out of their way to get an unregulated product, without harming anyone but themselves, then why should they be stopped?

> Baby milk is a disingenuous analogy since it's not expected to be consumed by the buyer. This is a disingenuous argument. FDA doesn't regulate only stuff that is not expected to be consumed by the buyer. GP could have said wine instead of baby milk.

And yet they chose baby milk, not wine. Why?

Because not everyone would agree that governments should necessarily regulate everything that you consume. Especially when it's advertised as "consume at your own risk".

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#49

Post by root_axis »

k__ wrote: post #31
Yizahi wrote: post #25

Just remember - code is law. No takesies-backsies :)

If they didn't use a centralized service like Cloudflare, this might not even have happened, lol.

Perhaps, but we know this kind of thing happens all the time even without something like Cloudflare in the mix

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#50

Post by drran »

ianpurton wrote: post #34
deweller wrote: post #15

It is important to note that this was not a smart contract exploit. The point of failure here was the website UI. Users were sent to a malicious website due to a stolen Cloudflare API key. What can DAOs do to prevent the single point of failure that is the web front end? Is there a reliable second level of security to ensure you are at the site you intended? The SSL certificate didn't work because Cloudflare was stil…

This is effectively a supply chain attack. To defend against it you need to secure the supply chain all the way from build to deployment. So a quick solution would be to run a job that checks your site every minute or so and compares the javascript against known hash values. Shut the site down if a hash has changed.

AFAIK, cryptocurrency companies are not looking for security experts at all. Users money are free, while company money isn't.
Post reply on HN