Latest DeFi exploits show audits are no guarantee

Raft Finance and Kyberswap both underwent multiple audits before being drained

article-image

Tiko Aramyan/Shutterstock modified by Blockworks

share

Two recent catastrophic exploits of two DeFi protocols differed in many ways, yet shared one commonality — both were audited multiple times.

Raft Finance, a stablecoin provider inspired by Liquity but backed by staked ether, fell victim to an infinite mint bug two weeks ago. KyperSwap saw its liquidity pools drained on Nov. 23.

The Raft team’s post-mortem analysis of the incident pointed out that, “the exploited Raft smart contracts were audited by Trail of Bits and Hats Finance. Unfortunately, the vulnerabilities that led to the incident were not detected in these audits.”

Kyber Network similarly flagged its platform’s audits from vaunted security experts, including 100proof, ChainSecurity and participants in an audit competition organized by Sherlock.

Loading Tweet..

Raft procured even more audits by Curious Apple and Aviggiano throughout 2023, indicating ongoing security evaluations and improvements​​ that have led onlookers to question the assumption that an audited protocol is necessarily safe.

Read more: Raft Finance floats user bailout plan after odd exploit

What’s needed is a “paradigm shift” in how blockchain projects tackle threats in the face of examples like these, says Halborn’s chief operating officer Dave Schwed, highlighting “sophisticated manipulation of smart contract functions.”

“It highlights the importance of projects taking a proactive and layered approach to security, beyond just relying on external audits,” Schwed told Blockworks.

Other smart contract specialists, including Yearn Finance security researcher Storming0x, concur. They said on X that it’s “a waste for a project to get an audit” absent attention to other best practices.

Loading Tweet..

It is also difficult for ordinary users to tell whether an audit covers the final code in production.

The Devil vulnerability is in the details

Theoretically, a user could compare the audited code with the current published version, Schwed noted.

“Most audit reports show, or should show, a hash of the repo of the code that was audited,” he said. “There should be some automated mechanism to compare the code audited and the code in production enhancing transparency and trust.”

Michael Lewellen, head of solutions architecture at Open Zeppelin, noted that “change management” — ensuring the production version matches the audited one — was not an issue in Raft’s case. However, he does see a tendency for some development teams to ignore the advice of their auditors.

“Trail of Bits, despite missing the bug itself, did note in their report that the Raft codebase could have made improvements to their testing and verification,” Lewellen told Blockwoks.

“These recommendations should not be taken lightly by projects that might otherwise assume the audit report gives them the all-clear to launch without making improvements to other parts of their security stack,” he added.

Making users partly whole

After receiving feedback that it was unfair to exclude those who sold their R following the depeg event, Raft retracted its initial recovery plan.

A revised “recovery plan” was published Friday, giving victims until the end of March 2024, to recoup a portion of their losses.

“After substantial feedback from the Raft community, the Raft Recovery Plan has been finalized, resulting in a 42% recovery rate. This guide is for all the affected users who were included in the Raft Recovery Plan to claim their DAI,” the plan said.

For Kyber, the scale of the loss was significantly greater — some $48 million. The road to recovery is still unclear.

Loading Tweet..

The KyberSwap exploit, noted for its unusual sophistication, has left DeFi users wondering about the level of yield that could justify their risk-taking.


Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.

Tags

Upcoming Events

Salt Lake City, UT

MON - TUES, OCT. 7 - 8, 2023

Blockworks and Bankless in collaboration with buidlbox are excited to announce the second installment of the Permissionless Hackathon – taking place October 7-8 in Salt Lake City, Utah. We’ve partnered with buidlbox to bring together the brightest minds in crypto for […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

Research Report Cover Vertex.jpg

Research

The proliferation of new perp DEXs has led to fragmented liquidity across various DEXs and chains. Vertex, known for its vertically-integrated DEX that includes spot, perpetual, and integrated money markets, is now tackling cross-chain liquidity fragmentation through horizontal integration with the launch of new Edge instances. Vertex's integrated offerings and cross-margined account structure amplify the benefits of new instances: native cross-chain spot trading, optimized cross-chain basis trading, consistent interest rates, reduced bridging friction, and more.

article-image

Partnering with EtherFi and Angle, the fully on-chain perp DEX features bespoke collateral

article-image

Sponsored

Gavin Wood introduced the next evolutionary step for the Polkadot network: the Join-Accumulate Machine, or JAM

article-image

The side events were the places to be at Consensus 2024, according to attendees

article-image

Also, who’s come out swinging in the spot ether ETF fee war — and who could undercut them

article-image

I know it is not in their nature, but US regulators could learn a lot by researching the digital asset frameworks that overseas regulators have already gotten right

article-image

Also, the ETF hype train can count out at least one member