How to Hack a DeFi Protocol

Transcript

it's working [Music] hey folks uh welcome to my talk hello now we'll be talk from madid Gupta from polygon thank you uh thanks for the intro so hey everyone I am Motel Gupta I lead security and smart contracts at polygon and if anyone doesn't know polygon works on scaling ethereum we are building layer 2 Solutions powered by ZK uh Tech and validium to scale up ethereum today I'm gonna talk a little bit about how to hack a D5 protocol and obviously how to protect yourself from those

attack vectors I'll demo it as well with perhaps the most famous hack the Dao hack where it all started really and then if we have time I'll let anyone propose their code that we can do live testing on so if you any any of you have written any code recently keep it ready so to get started uh let's talk about what makes a D5 protocol and what the weak points are so there are really two Pathways to attack a D5 protocol one is the Smart contracts uh themselves and the other part is the traditional security side so before I move on one

thing like I was gonna have slides but my dog ate my slide so no slides for now so I'll go ahead without slides and I'll cover both parts a little bit the traditional side and the non-traditional side day trading from when I say tradition I mean web 2 and non-traditional is web three uh traditional side is something which has been overlooked in this space a lot but we see like The Bigs hacks hacks that are happening are more on the traditional side than the web 3 side a good sorted example would be multi-chain which like they literally released their story today if anyone hasn't read their tweet it's hilarious go ahead and read it read it the etldr is that multi-chain

claimed to be an mpce bridging protocol but turns out all the MPC nodes were running in this one guys Cloud Server so it was basically one guy running multiple nodes and then that guy got picked up by the Chinese government the team lost contact with it and they had no idea what to do uh with the servers now so this guy's sister steps in and handles them but then the Chinese not the Chinese government someone moved funds from the uh protocol to some other address allegedly the Chinese government since that guy is under their control and then this sister tried to White hack it and got into the into his into the

brother's laptop opened their cloud account or whatever and move the funds somewhere else uh surprise what next day the sister goes missing as well apparently picked up and now all of the money is gone and nobody has no idea where the money is you can guess where the money is but it's an interesting story of a bunch of failures if we go down they failed at multiple steps one the first step is firstly why did an MPC protocol had all of their servers in one single guy's account so that's one traditional security failure has nothing to do with blockchains then the other failure is why did that guy's sister have access to their computer like great object like

you are securing millions of dollars and just your random family member can access everything uh then their like emergency response plan or whatever uh system moves funds to her own address voila like how successful that was uh she also gets picked up so bunch of cascading failures there but moving on from there other attacks in the space the big ones the Iran in Bridge attack another uh traditional attack which was Ronin was another Bridge uh multi-party bridge but they were a five by nine multi-stick basically not a multi-stick but a five by nine MPC protocol the problem with them was similar four of those five were running on basically one

uh Center one server or one collection of servers and those servers had access to the fifth server for whatever reason so the attacker only compromised one devops employee of that company who had access to all the four servers and those four servers had access to the fifth server and voila everything on again there are many traditional security failures here one is four servers on the same uh like Cloud account or whatever and then second Vector would be four servers having access to the fifth server then the server has been accessible by a devops employee and then the devops employee following pray to these

phishing attacks another traditional security failure and a bunch of these so a collection of these traditional security failures led to these hacks if any one of the levels would have been fine they would have been fine security is all about having layers of security so those are some examples of traditional now we'll move to some more blockchain site where it is mainly things on the blockchain itself on the smart contract side you manipulate the smart contract to do what you want and voila you have free money so not free but almost free money uh there are numerous examples of these as well the one of the biggest ones uh recently that happened was Nomad Bridge

so Bridge seems to be a good theme here a lot of bridges getting hacked these days but Nomad had a logic issue in that a bug that got slipped uh during Audits and that led to an hack uh unfortunately we don't have much time to go into the details of that but similarly another big one that happened recently was Euler so uh Avila was oil is not a bridge so that's something unique about them but what Euler did was they added a function which is arguably not as useful to the code to increase the functionality but guess what that function had a critical bug so some key lessons here one is like if you're working with smart contracts

and big chunks of money avoid changing code and avoid adding features that maybe are not necessary uh because these features may end up resulting in hacks like this Euler did six audits but they still got wrecked and the reason is like one first of all these upgrades may be were not necessary they were taking additional risk every upgrade you do is additional risk but also the fact that despite six audits overall there was only one audit done on the final code on the last rate so saying six audit it's maybe a misleading word like only one company audited the buggy code and it's very easy to slip through

so those are some examples but now let's imagine from our scenario as an attacker how would you attack this so uh if you're going the traditional Parts there are like a bunch of guidelines and tutorials already uh you would probably start with finding attack vectors you can attack so centralized point of failures it might be multi-set key holders it might be MPC servers it might be hot servers holding keys for exchanges something like that and then you would probably try to do fishing that is the most easy attack path right now so uh for on the counter you you should do phishing awareness training for your employees so then don't fall prey for it but you would likely go down a fishing route or a social engineering

route you can also try pen testing uh the regular good old stuff getting into the server but most these days that path is usually usually closed off so you have to go the social Parts humans are really the weakest link in security you can secure computer utilize reliably securing humans reliably is super hard just get them drunk and it's game over so that's very hard part which you would attack but now let's also move a Step Beyond uh let's get into the D5 things let's get into the web 3 stuff which is arguably more interesting and arguably more accessible um and easier if you just have the right

knowledge and you are looking at the right place at the right time you can do it and similarly like from a security point of view from the reverse people have to understand that as a security person I have to get it right every single time I can't let any bug go through any of my things but as a as an attacker I only need to attack one weak point I only care about one so although from a security person I have to make sure I secure every single bit the attacker only has to look at the critical pieces and exploit what they can they don't need to go through the whole piece and that's the main strategy both to doing audits to prevent these attacks and also to attacking a protocol

if you start auditing a whole protocol if you want to attack it you won't make it uh so far you just need to focus on the key bits um I think I'll showcase it with a live demo if I can figure out how to exit the full screen I don't know I press something else okay anyone knows how to exit full screen on Mac or switch tabs anyone anyone anyone okay no search open

and not this one now I have full screen I don't know maybe a functional and I clearly don't use Mac I'm a Linux guy um oh we got it thanks okay we won't go full screen this time we'll stay here so this is the Dao repo original contracts that got wrecked we'll go through these have been a long time since I looked at this code so bear with me but let's go through it so if you are trying to attack uh any smart contract really what you will do is first of all open the service code

if it's available which it is here and then we'll go through uh the code and look for most critical pieces so first of all I'm just glancing through the code for some highlights and make sure I'm at the right file and once I verify that I'm on the right file it seems like it big enough code should be the right pace uh and like basically you have all of this code here uh you can from an attacker perspective so I'm really now looking at this from an attacker's perspective I don't know anything about this code base let's say so I look at the source code I find the most interesting file I open it and then

what I find for is value transfer where is value being transferred so to find that you look for a few things in D5 smart or solidity smart contracts one is the transfer function which literally means transfer value one would be the send function in solidity which transfers ether one would be the dot call function in solidity which makes arbitrary call and can also pass ether one would be approve function which is used in erc20s and so on so these are the critical points um from where we'll walk backwards so we'll let's start finding these things and if I can find how to search for it okay I found it yes um so let's go with uh dot transfer

okay this is a different keyboard than qwerty okay so let me also add okay I can't find the opening braces so we'll search through this okay there's one transfer function here which is sending it it is taking tokens from the user and sending it to zero so that's not very useful for us we want to take the we want the contract to send us the tokens no not send itself the tokens so we'll move forward same thing this is an internal function we'll skip over

super transfer not very useful no no no so basically as an attacker that's what you do you go through uh these pieces just looking at where the value has been transferred and so far I've been through the whole contract transfer is not transferring any value so I'll go with call next it would go really fast if I could find the opening braces but [Music] um okay okay this one is interesting so this one obviously transfers value of P amount uh to the recipient now this is one value transfer and all let's notice

where it's happening it's happening and execute proposal so um I guess so one thing you should also do which I didn't do is if you are trying to attack something read like a brief overview of the of what the contract does so you know what you are looking for and what is the expected functionality the Dao as name suggests is um was uh it has features of governance it's an autonomous Dao so it has features like executing a proposal proposing a proposal and things like that so this is proposal execution this is uh definitely one way to attack it but a proposal if it has to be executed it needs to pass through governance so governance will need to approve this and

then only then we can get funds from it so if if I have to exploit this I will go start now I found a one Value Place now I'll keep walking backwards now how can I execute this value transfer by having the vote pass how to get the vote pass uh get the governance uh through it so I will start looking into how can I manipulate the covenants to get my votes here most likely in this scenario I will not end up as a positive result because we have knowledge that this was not the attack Vector that was used on the Dow so I won't spend much time here but I would have gone reverse from here if I was actually looking for an attack to see if there is any path I can enter and then walk back down

so we'll go to the next call this is withdraw this is interesting I'll come back to this but let's see what else we have we have new contract uh new contract is not too interesting either because this is blocked here so withdraw is the most interesting bit so withdraw is used by token holders to withdraw their funds and we know uh this was the attack Vector that was used to hack the doubt so we have some pre-existing knowledge but we'll follow the same process now we found a value value transfer in the contract one critical bit and we know if we we can break this we will have our funds let me figure out if I can zoom in this

screen probably not so we'll stick around okay I found it I think I think that's open maybe that's why it's fine okay it won't hopefully people can see it now you can go maybe one more okay so withdraw is the most important bit we found the value transfer here so what this line says is uh transfer all money or transfer this much amount

of money to the user that's all it does now we see like how is this money coming where is this money coming from so it's uh the money is coming from your balancer user needs to have an actual balance and then throw rata based on their balance they get the balance out of the contract so if I hold five shares or five balance then actual balance by total Supply so basically you can imagine like I get my balance back from this contract simplifying it so it checks for your balance and then sends you the money uh this line not very useful we can ignore uh we are we assume we are not blocked by the voting so uh now you have to have some solidity knowledge as well uh to find these

issues uh which is a precursor if you want to get into D5 but once you have the basic knowledge you can see something that is wrong here you'll only see it if you know what call does and what call does is is it passes over the execution flow to the uh coli so message sender here I'm making a call to the message sender that hey knock knock here are your funds and now you do whatever you want with these funds in most cases and in the expected case here the person or the message sender will take the funds and say okay thanks for the funds now you can do whatever you want I don't want to do anything else with these that's the expected use case but what

this message sender can also do is be malicious so it can when it gets the call and it gets the fund uh it will say okay thanks for the funds and I have the control now you can go buy and now since I have the control it will go back to this contract called the withdraw function again and uh innocently go there uh knock the bank and say hey I have this balance can you give me the money I hold and the bank would go here check hey okay this guy has some balance here here's your money go and then you'll get the money you will get the control you'll go back to the bank again maybe do a different branch knock again say hey I have balance in your bank can you give me the money and uh the uh like

cashier would be like okay let me check your balance okay you have some balance here's your money go and the issue here if you have seen is the bank is not updating the user's balance it's just giving it the giving them the money uh here they do update the balance but they updated down here later balance message and equal to zero so they do update it but they updated after giving the money to the user so you have this uh like weird Edge case in between weird time in between where you have already gotten the money from the contract or from the bank but the information hasn't been propagated uh to other places yet the other branches of the bank don't know this yet so you you

are basically exploiting it by re-entrancing you take the funds once you get the control you go back to the contract you ask for funds again and the contract will give you again because it doesn't know that it hasn't updated its state yet the information has not been processed yet um it's like a concurrency problem in with three of in web 2 world uh if you do it in a bank it won't work as soon as you take out money all of the branches of the banks will know okay your balance has reduced they'll reduce it before giving you the money maybe make you wait two days before giving you the money but they'll reduce it first uh which we fail to do here we give the money first and then we're like okay we trust the user we'll reduce it where is he gonna run

um but yeah he ran back to us took more money so this is one practical example and one specific bug you can look up in D5 smart contracts just start looking for Value transfer go back from it how did this value transfer happen and try to hijack the process at any stage if you can hijack here or the parent function or the parent function doesn't matter once you hijack you just follow the path and you take the money out so this is how you start now imagine like this doesn't work like I go through everything none of the these uh like value transfers are really exploitable so what do you do then then you have two choices either move to the next Target there are plenty

of fishes in the sea or you go deeper now when you go deeper so yeah the first stage the value transfers you have verified they are all fine the second you would do is uh try to see where it's integrating where the external input is coming and try to attack that so if it's a uh D5 protocol which may be using oracles see we can Target that and do some price manipulation you can do maybe uh like a uni Pool price manipulation sandwich attacks and things like that so you go a Step Beyond if you can't find a hack here you go one step um overboard and you try to manipulate A system that this uh protocol is depending on and it has wrong assumptions about that system and if

that doesn't work out then you probably have to do a full audit if you still want to attack this or you can go for a different contract obviously we are talking about bug bounties we are finding bug bounties here there is no hack uh we are suggesting so you'll just open you Minify find the other protocol and try to find a bug Bounty there so that's uh the Dow hack and one practical example now do I have time I have a few minutes anyone has any contract of theirs that they want me to go live okay that is too big to go live uh in 10 minutes any simpler one I would say not really so maybe I can just talk

about the polygon Bridge a little bit since you brought it up and or not maybe the polygon Bridge I'll talk about bridges in general because that's a very interesting topic and we see Bridges keep getting hacked again and again and again and again so it's clearly something people haven't figured out how to do properly not everyone at least so in bridges I really see them uh that they are of three types one is a decentralized bridge which derives its security from the parent chain so a bridge basically Bridges token from chain a to chain B and in most cases there would be a major chain chain a and a child chain chain B like uh if you talk about polygon Z KVM the major chain is ethereum and the child chain is ZK

AVM uh which is a layer two so a decentralized bridge that we have here derives its security from uh ethereum completely the only two ways to attack it is either find a code vulnerability a logic vulnerability or just attack ethereum so the way it works uh in broad sense is that you generate proofs of something happening on one chain and then you verify those proofs all automatically on the other chain and once you verify that I moved my token to the bridge contract on the parent chain then the child contract here can release tokens so it's it's all proof based you

have a proof something happened on chain a if it can be proven on chain B it will give you the funds so there is no centralization risk no centralized party you can generate your own proofs you can submit your own proofs and so on the only possible bug vectors here are really like attacking ethereum let's say is a hypo and is assumed to be not possible right now so the only attack Vector that remains here is implementation risk if there is a bug in the smart contract which can exploit this which is a very valid issue so you have to be careful about it but these are generally believed to be the most secure Bridges and good example as I mentioned is the polygon Z KVM

Bridge here the other type the second type of bridges are the MPC Bridges the multi-party compute Bridges here usually there is a set of nodes which uh pass message from one chain to another and if majority of the nodes agree then the message is bridged uh here like the nodes can be in config of two by three like the harmony Bridge which got wrecked uh like five by nine uh like the Ronin Bridge which got hit uh like multi-chain which I would say one by one which again got hacked and so on so there are like these MPC protocols and the way they work is you do transaction on one chain these nodes look at the

transaction they are running uh the nodes of these genes and they once the transaction happens they post it on the second chain they say hey this one transaction happened on there so we should do the corresponding bridging if enough nodes post the same message then it's actually executed and the bridging happens so it's basically a voting mechanism in theory it can also be secure for two reasons one is technically it's easier to implement than the decentralized bridge so the risk of smart contract uh hack here is lower and as we have seen the MPC bridges that have been hacked have mostly been hacked via the traditional exercises the smart contract hacks have not really affected them

because it's relatively easy thing to build uh so on the traditional side uh obviously if you do a two by three like MPC or if you do a five by nine MPC if you do a one by one MPC it's not secure you need to go higher uh polygon POS Bridge is a mix between MPC bridge and a decentralized bridge in the sense that there still are proofs but they are the message passing happens in an MPC layer and for that we have 100 validators uh not one three or nine so there are many uh decentralized validators and we are not the ones that are running all of these validators they are run by the public in a decentralized fashion so

that's a much more secure and harder to break away so that's one type of bridge in this bridge the attacking vectors are really the traditional side if you can break the MPC if you can get into the servers that are running these nodes it's all yours and this is what we have seen in the past so if you are running a bridge of this type make sure you pay attention to your traditional security make sure your key management is secure make sure you have a high ratio of MPC and then you would likely be fine the third type of bridges are really the centralized ones which are like just one entity for example you put money in binance on orbitrum and you withdrawing on ethereum you have essentially Bridge money from arbitrum to ethereum but you used a

centralized Bridge which was balanced uh here all of the security depends on the traditional security practices of Finance Key Management hot hot wallets and so on there is no smart contract involved it's all traditional security another so another example of this would be the Avalanche Bridge actually a launch bridge is an eoa actually it has no on-chain multisig or anything um it's one by one eoi but off chain they have an MPC algorithm which is I think three by four or four by four so arguably not sufficient but at least something and they do it on Intel sdx so it's uh it's relatively secure Tech wise although they can bump up the MPC

numbers and that would be really appreciate if anyone from Avalanche is hearing so those are the centralized Bridges I would say if you want to attack those or if you want to secure those then again you have to focus on traditional security 100 make sure your key management is safe make sure you are not storing secrets and plain text on your hot servers running in some devops account make sure access to those servers is also secure make sure your devops employees are properly trained for fishing awareness and things like that so you don't get tricked and these are basically like the three types of bridges and three different security mechanism there for the decentralized bridges just make sure your application is secure get a bunch of audits get bug

bounties live get these audit contests done by Sherlock code Arena and these companies get a lot of independent reviews look at it uh have a lot of fuzzing let you can try for formal verification using Satora but most importantly just have an open security mindset and have good test cases most of the things can be caught by test cases honestly I'm just having an open mind then the other side uh the middle layer where you have traditional security as well as smart contracts you have to do both so these are the bridges that most often get hacked you have to be secure on these smart contracts which is relatively easy to do and you have to be

secure on this uh traditional security side the only saving grace here is that it's all very common very documented there are known best practices so you can just follow the best practices and be done with it and the first one did centralized Bridges like maybe just stop building them if you are building them then make sure your traditional security is fine and then you'll be fine it will all uh be happy we'll all be happy no more hacks and we'll all live happily after and that was a quick short talk if anyone wants to reach out to me then they can reach out my contact details are on my blog modet dot blog I can find

the letters here but you get the idea oh I have managed to type it not right still but yes you can contact me through my blog and happy to talk thanks everyone thank you any questions [Applause] anything anything about attacking a D5 Bridge D5 protocol or security or polygon anything that we don't do we keep it there thanks for the great talk my question was also uh on chain

attacks on Bridges like Nova protocol for instance yes the issue was synchronization of Merkel root yeah on either side so how do you try to model that also into account yeah so that would fall in the uh like decentralized Bridges category so it's more a smart contract risk slash software risk if there is a buggy software then obviously you are going to lose money and it's super complex to actually build and secure these Bridges which people underestimate and say like decentralized bridges are the best yes in theory they are the best but they are also the hardest to secure from a code point of view so that's why I said you need a good developers who understand security and will build this thing ground up with

security in mind you need them to write good test cases you want fuzzing in there you want to get in some formal verification if you can although it's hard for these complex cases you want to do good audits with reputable vendors you want a good bug Bounty program polygon has a very successful bug Bounty program we offer bounties of over a million dollar and we have had very very interesting findings through that which all Auditors missed so yeah just those are the ways to secure it so just a follow-up question uh in case you said Euler example that adding another function creates this security Threat Vector how can we modelize in real time let's say we want to change

the protocol using a new proposal how can we modalize it is there possibility to let's say there is formal verification other aspects yeah so a couple of things there one is like uh if you have to do it then there are ways uh like for continuous integration one is obviously your test cases should always be passing if you go formal verification route with Satora you can have the same rules be verified every time and um like you just get audits ideally from the same people so have the whole context but in the first place to be honest you would try to not upgrade a contract unless it's absolutely

mandatory so upgradability is a double-edged sword I like upgradability because it allows you to get out of sticky situation if you find a bug in a contract you can upgrade it you can save your life but I don't like upgradability when it's used to add a new tiny feature then it it's always about risk management whenever you add a feature you're taking on risk and you have to ask yourself is that feature worth the additional risk or not often times at least for me it might not be worth the risk hi there um my question is concerning the future of like what's next um a few years ago we had cross-atomic swaps now we have the new innovation of

bridges what in your opinion is going to be so groundbreaking that comes in the next few years yeah sure so that's a very big question for me there are two things here one is like I I really believe in a multi-chain future um not the protocol but multi-chain in this sense there are many different independent genes that will live at the same time but I do not really believe in a cross chain future I don't think uh people will be moving funds uh like doing transactions on Two Chains atomically I'm not a big fan of that just because the because of the complexity of that and I like to compare this with the real world so there are many I like to think of change as cities

there are many major cities in the world right now and you can go from one city to another using a flight or maybe a bridge if they are close enough so you can there it's a multi-city world you can go across different cities but you can't have your leg in Two Cities at the same time it's just not possible it's super complex so I like to think of it as analogy I use and the other thing I'm really bullish on and I think it's gonna be big is uh ZK uh scaling technology because scaling is a big bottleneck for our Tech to grow if we can solve this we will immediately have lots of new interesting use cases that are just not

viable right now because it's too expensive if you look at internet internet was never free internet is still not free but it's affordable enough that nobody cares how much it's costing every time you open a web page the website host is paying money to their web host to serve you the page the data on internet still costs money but nobody cares every website is free to browse every user has an internet pack they don't pay per website visit or anything like that just because it's so cheap that it can be bundled together and that's where I think ZK Tech will take us the transactions would be so cheap that everyone would just use blockchains without worrying about costs for your talk and uh now is uh time for

our next speaker [Applause]