Latest DeFi exploits show audits are no guarantee

Raft Finance and Kyberswap both underwent multiple audits before being drained

article-image

Tiko Aramyan/Shutterstock modified by Blockworks

share

Two recent catastrophic exploits of two DeFi protocols differed in many ways, yet shared one commonality — both were audited multiple times.

Raft Finance, a stablecoin provider inspired by Liquity but backed by staked ether, fell victim to an infinite mint bug two weeks ago. KyperSwap saw its liquidity pools drained on Nov. 23.

The Raft team’s post-mortem analysis of the incident pointed out that, “the exploited Raft smart contracts were audited by Trail of Bits and Hats Finance. Unfortunately, the vulnerabilities that led to the incident were not detected in these audits.”

Kyber Network similarly flagged its platform’s audits from vaunted security experts, including 100proof, ChainSecurity and participants in an audit competition organized by Sherlock.

Loading Tweet..

Raft procured even more audits by Curious Apple and Aviggiano throughout 2023, indicating ongoing security evaluations and improvements​​ that have led onlookers to question the assumption that an audited protocol is necessarily safe.

Read more: Raft Finance floats user bailout plan after odd exploit

What’s needed is a “paradigm shift” in how blockchain projects tackle threats in the face of examples like these, says Halborn’s chief operating officer Dave Schwed, highlighting “sophisticated manipulation of smart contract functions.”

“It highlights the importance of projects taking a proactive and layered approach to security, beyond just relying on external audits,” Schwed told Blockworks.

Other smart contract specialists, including Yearn Finance security researcher Storming0x, concur. They said on X that it’s “a waste for a project to get an audit” absent attention to other best practices.

Loading Tweet..

It is also difficult for ordinary users to tell whether an audit covers the final code in production.

The Devil vulnerability is in the details

Theoretically, a user could compare the audited code with the current published version, Schwed noted.

“Most audit reports show, or should show, a hash of the repo of the code that was audited,” he said. “There should be some automated mechanism to compare the code audited and the code in production enhancing transparency and trust.”

Michael Lewellen, head of solutions architecture at Open Zeppelin, noted that “change management” — ensuring the production version matches the audited one — was not an issue in Raft’s case. However, he does see a tendency for some development teams to ignore the advice of their auditors.

“Trail of Bits, despite missing the bug itself, did note in their report that the Raft codebase could have made improvements to their testing and verification,” Lewellen told Blockwoks.

“These recommendations should not be taken lightly by projects that might otherwise assume the audit report gives them the all-clear to launch without making improvements to other parts of their security stack,” he added.

Making users partly whole

After receiving feedback that it was unfair to exclude those who sold their R following the depeg event, Raft retracted its initial recovery plan.

A revised “recovery plan” was published Friday, giving victims until the end of March 2024, to recoup a portion of their losses.

“After substantial feedback from the Raft community, the Raft Recovery Plan has been finalized, resulting in a 42% recovery rate. This guide is for all the affected users who were included in the Raft Recovery Plan to claim their DAI,” the plan said.

For Kyber, the scale of the loss was significantly greater — some $48 million. The road to recovery is still unclear.

Loading Tweet..

The KyberSwap exploit, noted for its unusual sophistication, has left DeFi users wondering about the level of yield that could justify their risk-taking.


Don’t miss the next big story – join our free daily newsletter.

Tags

Upcoming Events

Hilton Metropole | 225 Edgware Rd, London

Mon - Wed, March 18 - 20, 2024

Crypto’s premier institutional conference returns to London in March 2024. The DAS: London Experience: Attend expert-led panel discussions and fireside chats Hear the latest developments regarding the crypto and digital asset regulatory environment directly from policymakers and experts.

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

Research report - cover graphics (1).jpg

Research

In this report, we dive into crypto private market data to gather insights on where the future of the industry is headed. Despite a notable downturn in private raises, capital continues to infuse promising projects that aim to transform payments, banking, consumer experiences, community, and more, with 2023 being the fourth-largest year for crypto venture capital.

article-image

BUZZ holds shares of Coinbase, Robinhood and MicroStrategy

article-image

Opinion: Even though I didn’t pay for my “Diamond Hands” burger with BTC, don’t let that fool you into thinking that crypto’s development is futile

article-image

The results mark “a major positive inflection point,” one analyst says, as the exchange carries net income momentum into a crypto rally

article-image

While the slate of 10 US spot bitcoin funds have tallied $4.6 billion of net inflows thus far, half of the field is lagging the leaders

article-image

Trading volumes totalled $154 billion in Q4, including $125 billion in institutional volume

article-image

DeFi on Bitcoin is all the rage right now and Stacks is positioned to benefit