Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DeFi protocol BadgerDAO exploited for $120M in front-end attack

theblockcrypto.com

Post reply on HN
Print view View original

51–60 of 151 posts

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#51

Post by legutierr »

throwaway248329 wrote: post #6
rvz wrote: post #2

Another day another DeFi project rekt. What happened: > The front end to the BadgerDAO website was reportedly acccessed, according to comments in the project's Discord channel, and used to intercept transactions. One admin said it appears that an API key for Cloudflare was compromised. > One user had around 900 bitcoin ($50.8 million) worth of tokens stolen in a single transaction. Another lost $5 million worth of to…

Regulations in DeFi would do nothing but turning it into traditional, permissioned finance but on blockchain. Nobody wants that.

Not true! A lot of code written for financial applications, and a lot of the complexity in those systems, is there just to synchronize, reconcile and settle between the independent data silos maintained by the various entities involved in a transaction. Blockchains can do a lot to eliminate that complexity.

Also, there are interesting advantages to the transaction authorization model that blockchains have whereby a message is valid only if signed by the sender, enforced down to the data layer.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#52

Post by ricardobayes »

VoodooJuJu wrote: post #44
rvz wrote: post #2

Another day another DeFi project rekt. What happened: > The front end to the BadgerDAO website was reportedly acccessed, according to comments in the project's Discord channel, and used to intercept transactions. One admin said it appears that an API key for Cloudflare was compromised. > One user had around 900 bitcoin ($50.8 million) worth of tokens stolen in a single transaction. Another lost $5 million worth of to…

900 bitcoin. Just sitting there in some fragile little exchange, or whatever this DAO is. If these people are so rich, why aren't they so smart?

Probably a 'business' account

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#53

Post by ceejayoz »

Grustaf wrote: post #47
Nextgrid wrote: post #35

Earlier quoted context omitted.

I don't understand how these mixer services work with regards to law enforcement. Wouldn't the any outputs of such laundering services be considered dirty to begin with, regardless of whether or not the supposed inputs were clean originally? If anything, I'd expect the output of such a service to be even worse than most inputs, as the money will be mixed with all the inputs, some of which would be associated with hor…

Isn't that a bit like saying cash is dirty? I don't think we are under obligation to keep our funds traceable? Perhaps we are getting closer to that point though.

> I don't think we are under obligation to keep our funds traceable?

Oh, you do. Not being able to prove the source of your funds puts you at serious risk of asset forfeiture.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#54

Post by splendidHaiku »

Yizahi wrote: post #25

Just remember - code is law. No takesies-backsies :)

The person who lost the 50 million probably insured his money with something like https://nexusmutual.io/. If you invest a large sum, you should always insure it against hacks.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#55

Post by root_axis »

throwaway248329 wrote: post #48
Kbelicius wrote: post #42

Earlier quoted context omitted.

> Baby milk is a disingenuous analogy since it's not expected to be consumed by the buyer. This is a disingenuous argument. FDA doesn't regulate only stuff that is not expected to be consumed by the buyer. GP could have said wine instead of baby milk.

And yet they chose baby milk, not wine. Why? Because not everyone would agree that governments should necessarily regulate everything that you consume. Especially when it's advertised as "consume at your own risk".

> Especially when it's advertised as "consume at your own risk".

Yet alcohol is highly regulated, much more so than baby milk.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#56

Post by linspace »

Grustaf wrote: post #47
Nextgrid wrote: post #35

Earlier quoted context omitted.

I don't understand how these mixer services work with regards to law enforcement. Wouldn't the any outputs of such laundering services be considered dirty to begin with, regardless of whether or not the supposed inputs were clean originally? If anything, I'd expect the output of such a service to be even worse than most inputs, as the money will be mixed with all the inputs, some of which would be associated with hor…

Isn't that a bit like saying cash is dirty? I don't think we are under obligation to keep our funds traceable? Perhaps we are getting closer to that point though.

We are totally under the obligation to justify funds. To start with, because taxes, but also there are a lot of legislation put in place to prevent money laundering under threat of very high fines for non compliance, even if no laundering happened

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#58

Post by splendidHaiku »

malthaus wrote: post #22

"Decentralized" also means nobody takes accountability, something a lot of our society is built upon, evolved over many generations. But a mix of snake-oil salesmen and nerds dreaming of utopia try to convince everybody that their approach is somehow magically better.

No. "Decentralized" means everybody takes accountability, as opposed to just one corporation. But you have to make use of it - e.g. by using https://nexusmutual.io/.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#59

Post by throwaway248329 »

root_axis wrote: post #55
throwaway248329 wrote: post #48

Earlier quoted context omitted.

And yet they chose baby milk, not wine. Why? Because not everyone would agree that governments should necessarily regulate everything that you consume. Especially when it's advertised as "consume at your own risk".

> Especially when it's advertised as "consume at your own risk". Yet alcohol is highly regulated, much more so than baby milk.

But does it make "perfect sense" to regulate it? No. Especially not when there is a large group of population who disagrees to those regulations.

Re: DeFi protocol BadgerDAO exploited for $120M in front-end attack

#60

Post by Stevvo »

deweller wrote: post #15

It is important to note that this was not a smart contract exploit. The point of failure here was the website UI. Users were sent to a malicious website due to a stolen Cloudflare API key. What can DAOs do to prevent the single point of failure that is the web front end? Is there a reliable second level of security to ensure you are at the site you intended? The SSL certificate didn't work because Cloudflare was stil…

DAOs nearly always have their front-end in a public repository so you can run it locally, but this is also convenient for the Cloudfare hijacker.

One defence is ENS. If your DAO's contract is registered for example as "BadgerDAO.eth", and your users wallet software shows that every time they make a transaction then it will be a red flag when the contract has been swapped out in the compromised front-end.

Unfortunately many wallets don't support ENS, and in those that do the experience could be better. So better wallets are part of the solution.

Post reply on HN