Flash Loan Attacks: Anatomy and Prevention in DeFi Security

[00:00:00]november 17 2020 origin protocol posts this tweet ousd has been hacked the team is all hands on deck attempting to figure out what vulnerability was exploited and how the hacker was able to access users deposits now it didn't take long to figure out the origin of the exploit was the same one driving four other attacks on acropolis harvest value and cheese bank and it is fascinating because it's all about doing things very very fast [Music] see the origin of all these attacks was a flash loan allowing the attacker to borrow huge collateral and zero risk temporarily granting them the heft of a whale and the power to drain protocols in a matter of minutes using re-entrancy vulnerabilities and we're not talking peanuts here 45 million dollars in the last month alone that is a lot and i hope you brought a shovel and some weddings because yeah we're going deep this is the defiant [Music] okay so there have been five attacks and i thought it might be worth going to them in some detail to gain some insight so cheesebank an autonomous digital bank based on a decentralized protocol was drained of 3.3 million dollars worth of usdc usdt and dye by a hacker exploiting a bug in the way it measured asset price from an amm-based oracle on their website they say that they successfully passed the slow missed smart contract security audit then there's acropolis a decentralized finance protocol with products geared towards borrowing lending and yield farming and they had their delphi pool relieved of 2 million 30 850 die using a re-entrance attack with a didx flash loan and the attacker used his own contract as the deposit token now they had their smart contracts audited by smartdeck and certic now the largest single exploit occurred on yield farming protocol harvest where the hacker got away with 24 million dollars but then mysteriously returned two and a half million dollars and this was done via arbitrage manipulation using a 50 million dollar flash loan which enabled the attackers to severely stretch the price of that stable coin on curves why pool and it took them less than seven minutes to escape with i'm going to say it again 24 million dollars and the total volume of trading on curves usdt and usdc shot from 10 million dollars to over 2.7 billion dollars during the exploit and their smart contracts were audited by haiti audit next up was the value d5 protocol which was unburdened to the delightfully musical tune of six million dollars and more on that one later as it's well it's kind of a masterpiece their contracts were audited by pessimistic and arcadia group and there is a quant stamp audit pending but i was unable to find it and finally origin protocol they found themselves clutching at fresh air as seven million dollars worth of tokens were extracted from their coffers and the attacker there exploited a missing validation check in mint multiple to pass in a fake stable coin which was under their control and that allowed the hacker to exploit the contract with yes again a reentrancy attack in the middle of the mint and in the introductory medium post they do say that they will be providing the results of their smart contract audits but so far i haven't found any and that origin dollar is actually a pretty recent entry into the market now the specifics of these attacks vary but every single one of them began the same way with a flashlight so i know what you're wondering what the hell even is a flashlight a flash loan is a loan that is only valid within one blockchain transaction and flash loans fail if the borrower does not repay his debt before the end of the transaction borrowing the loan and this is possible because a blockchain transaction can be reverted during its execution if the condition of a repayment is not satisfied now the assets for the flashlight are taken from a publicly funded smart contract pool and the biggest flashstone pools right now are provided by ava and didx but you can also create flash swaps on uniswap now the concept of a flashlight originates with max wolf the creator of marble protocol back in the dark months of 2018. now marbles styled itself as a smart contract bank and its killer product was a profound defy innovation zero risk loans via a smart contract zero risk now that's radical then it also seems impossible right and if we look at regular old normal banking traditional lenders well they take on two forms of risk the first is default risk if the borrower runs off with the money then they have to try and get it back or write it off but that's kind of written into the terms of the loan the second form of risk to a lender is illiquidity risk if a lender loans out too many of their assets at the wrong times or doesn't receive timely payments then they can find themselves unexpectedly illiquid and not able to meet their own obligations flash loans mitigate both these risks and it works like this i the lender say to you the borrower i can lend you as much money as you want but only for this single transaction by the end of this transaction you must pay me at least as much as i let you but if you're unable to do that i will automatically roll back the transaction so that it never happened and that means flash loans represent zero risk and zero opportunity cost this is because the borrower essentially froze time for the duration of their flash loan so as far as anyone else auditing the ledger knows the system's capital was never at risk and never encumbered therefore it could not have earned interest elsewhere it didn't actually happen unless it happened but then if it did happen it never happened because it already happened and it's done wow flashlights were originally sold as arbitrage superpowers and here's marvel's original marketing statement with flash landing a trader can borrow from the marble bank buy a token on one decks sell the token on another dex for a higher price repay the bank and pocket the arbitrage profit all in a single atomic transaction in reality though arbitrage is normally performed by highly competitive arbitrages using cutting-edge bots there are other uses for flash loans though like seamless collateral swaps but of late they've mostly been used to power yes flash attacks and that brings up one more important point traditionally tremendous amounts of cryptocurrency were needed by individuals or groups that wanted to manipulate the market but with flash loans anyone can become a whale for a few seconds well i say anyone but if you go on ava's website for instance and you start looking for the flash loan button you won't find it and i actually wanted to do a flash loan for this film a live one and i found my way into ava's super helpful documentation where i was confronted with this flash loans are an advanced concept aimed at developers you must have a good understanding of ethereum programming and smart contracts to take advantage of them well i don't have any of those things so i don't get to be a whale not today damn it peck shield the blockchain security firm well they wrote a report on the cheesebank exploit and cited the other incidents as well saying in the string of attacks we have seen malicious actors use flash loans to instantaneously borrow swap deposit and again borrow large numbers of tokens so that they can artificially manipulate the price of a specific token on a single exchange like uniswap or curve and they go on to say this sequence is essentially the foot in the door allowing the attacker to then exploit that exchange's anomalous pricing and this really gets to the heart of how these exploits can be so devastating in what's known as price oracle attacks so what's really important to bear in mind here that is that the flash loan only provides the funding to execute an attack the flashlight itself is not the cause of the attack where the vulnerability actually lies is in the centralized oracle's i.e using a single dex as the protocol's sole price oracle and here's how that looks when an attack occurs so firstly what you're going to do is borrow a large amount of token a from a protocol supporting flash loans next you're going to swap token a for token b on a dex which lowers the price of token a and increases the price of token b on the dex then you're going to deposit the purchase token b as collateral on a d5 protocol that uses that very same dex as its sole price feed and then you're going to use that manipulated pricing to borrow a larger amount of token a than should normally be possible you're then going to use a portion of that borrowed token a to fully pay back the original flash loan and keep the remaining tokens generating a profit from the protocols manipulated price feed now as the prices of token a and b on the decks are arbitraged back to the true market wide price the d5 protocol itself is left with an under collateralized position with debt worth more than the collateral which directly harms the innocent users now because the attacker was able to open a flashlight and manipulate the on-chain exchange that a defiled protocol used as its sole price oracle they were able to raise the reported value of the token users collateral and lower the reported value of the token used as debt and make themselves a fat stack of cash sounds complicated it really isn't now earlier i talked about re-entrancing if you cast your mind back to may 2016 this was the very same attack that was used to hack the dao draining it of 3.6 million ether wrecked absolutely taken down and bringing about that very famous contentious hard fork now the dow itself had a vulnerable function meant to split off a child dial and the attacker used this function to recursively transfer funds from the original dow to the child dial that they controlled now a re-entrance here cac can occur when you create a function that makes an external call to another untrusted contact before it resolves any effects now if the attacker can control that untrusted contract they can make a recursive call back to the original function repeating interactions that would otherwise not run after the effects were resolved so with me the simplest example is when a contract does internal accounting with a balance variable and exposes a withdrawal function if the vulnerable contract transfers funds before it sets the balance to zero the attacker can recursively call the withdrawal function repeatedly and drain the whole contract and this is basically what happened with acropolis wow what are you saying after that one but of all the hacks this last month the one that really stands out is this one on their website value states that their mission is to bring fairness true value and innovation to defy and one of their four pillars is to protect community funds and provide peace of mind now the background to all this was that the project itself had made a huge point of broadcasting how resistant their protocol was to flashlights in a series of tweets that have now all been deleted hindsight's a values flagship product the multi-stables vault was supposed to have the following advantages one flashlight attack prevention two fake token attack prevention three re-entrance attack prevention but it turned out to have none of those at all and as stanley from other neatly put it building a resilient d5 is becoming difficult becoming i think we can safely say it already is but what really struck me when researching this film was the comments just good those things happen art like someone said i have to admire the intelligence creativity and complexity paraswap called it a mind-blowing hack and it reminds me of a medium post that hasi qureshi wrote back in february which is entitled flash loans why flash attacks will be the new normal and in it he called two bzx hacks magnificent now parasop included a bloxy visualization of the exploit and i'm just going to leave it here with some cultured music for you to enjoy and here was me thinking we've moved away from art after the videos of the last few weeks so what was so artistic about it well emiliano banasi did a great job of explaining it in his twitter thread but the tilde is that it involved not one but two flashlights one on ava and one on unit swap and he counted wait for it 16 individual steps that ended up with a cool 16 million dollars in the attacker's pocket ready one flashlight 80 000 east from other two flash swap 160 million die from uni swap three top eighty thousand for 31 million usd on unisop effectively seventy six point six thousand remaining three point three thousand each four deposit 25 million die on value multi-volt bank swap 91 million die to 90.2 million usdc on curve six swap 31 million usdt to 17 million usdc on curve 7. withdraw 33 million three crv from value multiple bank eight swapped 17.3 million usdc to 30.9 usdt on curve swap 19.2 million uscc to 90.9 million die on curve remove liquidity with 33 million three crv that's the three pool and curve for 33.1 million die on curve 11 swap 30.9 usdt for 76 000 each on unit swap 12 payback flash swap 160 million died to uni swap 13 swap 283 000 die to 606.9 eth on sushi saw 14 payback the flash loan 80.07 2k to other 15 transferred 2 million died to the value deployer 16 transfer 5.4 million died to the exploiter all in one transaction yes that is badass and that wasn't the end of it shortly after the exploit the attacker followed up with an ethereal transaction that seemed to taunt the value d5 protocol with a message sent directly to the protocol's deployer address and it said do you really know flash low wow what do you say after that one brutal savage wrecked okay so put yourself in the position of one of these teams you've hustled you've created that tvl and now suddenly someone who might very well be smarter than you and sharper than you has made you look like a fool but what do you do well let's take a look harvest who lost 24 million dollars put out a bounty of 100 000 to anyone who could return the funds but they also said the but following their discord they raised the possibility that they knew who this person was now i actually use the same tactic when trying to recover the ghost tokens that were taken from me but it didn't work and i suspect this won't work either if you've gone to all that trouble yeah you're not gonna be pressured out of it that easily so what about acropolis well they wrote an open letter to the hacker in which they offered a bug bounty of two hundred thousand dollars to return the funds for finding the exploit but there's an important question here over whether that actually sets a dangerous precedent that would encourage more hackers to follow suit in what would essentially amount to extortion the median post has now been deleted and what about value well some of the values victims actually sent messages back to the hacker via their input data function the messages were such as my grandparents and my parents sent me their life savings for high yield return that i boasted about and that one was apparently from a 19 year old student living in the united kingdom who said he'd lost 200 000 he continues i will be grateful if you can send the funds back and i will return them to my family you know what though the hacker did actually send some die back to a small handful of those who'd sent those messages but he also fired back another message i don't expect to get your money but as we've seen there are so many people here who lack knowledge and caution and sooner or later those money will be lost some wounds are painful but very effective some wounds are painful like that use of the english language now origin protocol also offered a bounty but this time for information matthew liu co-founder of origin protocol responded to the attack saying this is not a rug pull or internal scab despite this setback is very much in our intention to make ousd a safe secure and successful product that builds on the broader origin mission of peer-to-peer commerce we are offering a bounty of 1 million us dollars to anyone that supplies substantial informational evidence leading to the return of customer funds to the hacker we believe you've made your point to us and our community deployers deploying untested contracts before essential security audits have been completed need to be more comprehensive and diligent when developing their products so what about the fallout all this well let's take a look at the origin dollar which is backed not by fiat but by other stable coins and the origin dollar should in theory be pegged to one dollar so let's look how that was today wow what are you saying after that one savage worked now there's one thing that always strikes me is odd about these exploits why do the hackers return the money or at least a little chunk of money are they hoping that that's enough to stop investigative teams from coming after them or is it just to prove a point i don't know and it turns out i'm not the only one who thinks it's odd now the truth is a lot of what we see in the blockchain space is well how to be kind it's a woozy it's a fairy dust it doesn't exist it's never landed it is no matter it's not on the elemental chart it's not real so who knows what's really going on and if i'm honest i feel a little conflicted making this film when commenters call these attacks art is it really art a man can be an artist and anything food whatever it depends on how good he is i mean i don't know if you believe that a 19 year old was really given control of his parents and grandparents savings but i certainly don't however there definitely were victims in these flash attacks people who actually lost money and in my original script i was ready to unleash on the hackers this isn't art it's theft plain and simple but i'm wrong a few weeks back i exposed my private keys and people took my tokens and i argued at the time that the exposed keys entitled him to take a look but the moment they took the tokens well that was stealing but this is different because the truth is these flash attacks weren't hacks the attackers exploited vulnerabilities yes but they did it perfectly within the rules of the game in one article i read hackers described as apex predators and that seems a pretty much perfect name for them so if you were the victim then i'm afraid you probably just have to take your beats and move on but there is a bigger question here all of these projects bar the origin dollar have been audited by smart contract security firms so what the were they doing and what are those reports worth now hmm anybody caught on the street with this will get killed the takeout from all this is that if you leave the door open in crypto someone is going to slide in and they will probably stick your throat so think about that and i'll see you on the next one this was the defiant [Music] [Music] [Applause] [Music] 50 years of shine and freshness