Latest DeFi exploits show audits are no guarantee

Raft Finance and Kyberswap both underwent multiple audits before being drained

article-image

Tiko Aramyan/Shutterstock modified by Blockworks

share

Two recent catastrophic exploits of two DeFi protocols differed in many ways, yet shared one commonality — both were audited multiple times.

Raft Finance, a stablecoin provider inspired by Liquity but backed by staked ether, fell victim to an infinite mint bug two weeks ago. KyperSwap saw its liquidity pools drained on Nov. 23.

The Raft team’s post-mortem analysis of the incident pointed out that, “the exploited Raft smart contracts were audited by Trail of Bits and Hats Finance. Unfortunately, the vulnerabilities that led to the incident were not detected in these audits.”

Kyber Network similarly flagged its platform’s audits from vaunted security experts, including 100proof, ChainSecurity and participants in an audit competition organized by Sherlock.

Loading Tweet..

Raft procured even more audits by Curious Apple and Aviggiano throughout 2023, indicating ongoing security evaluations and improvements​​ that have led onlookers to question the assumption that an audited protocol is necessarily safe.

Read more: Raft Finance floats user bailout plan after odd exploit

What’s needed is a “paradigm shift” in how blockchain projects tackle threats in the face of examples like these, says Halborn’s chief operating officer Dave Schwed, highlighting “sophisticated manipulation of smart contract functions.”

“It highlights the importance of projects taking a proactive and layered approach to security, beyond just relying on external audits,” Schwed told Blockworks.

Other smart contract specialists, including Yearn Finance security researcher Storming0x, concur. They said on X that it’s “a waste for a project to get an audit” absent attention to other best practices.

Loading Tweet..

It is also difficult for ordinary users to tell whether an audit covers the final code in production.

The Devil vulnerability is in the details

Theoretically, a user could compare the audited code with the current published version, Schwed noted.

“Most audit reports show, or should show, a hash of the repo of the code that was audited,” he said. “There should be some automated mechanism to compare the code audited and the code in production enhancing transparency and trust.”

Michael Lewellen, head of solutions architecture at Open Zeppelin, noted that “change management” — ensuring the production version matches the audited one — was not an issue in Raft’s case. However, he does see a tendency for some development teams to ignore the advice of their auditors.

“Trail of Bits, despite missing the bug itself, did note in their report that the Raft codebase could have made improvements to their testing and verification,” Lewellen told Blockwoks.

“These recommendations should not be taken lightly by projects that might otherwise assume the audit report gives them the all-clear to launch without making improvements to other parts of their security stack,” he added.

Making users partly whole

After receiving feedback that it was unfair to exclude those who sold their R following the depeg event, Raft retracted its initial recovery plan.

A revised “recovery plan” was published Friday, giving victims until the end of March 2024, to recoup a portion of their losses.

“After substantial feedback from the Raft community, the Raft Recovery Plan has been finalized, resulting in a 42% recovery rate. This guide is for all the affected users who were included in the Raft Recovery Plan to claim their DAI,” the plan said.

For Kyber, the scale of the loss was significantly greater — some $48 million. The road to recovery is still unclear.

Loading Tweet..

The KyberSwap exploit, noted for its unusual sophistication, has left DeFi users wondering about the level of yield that could justify their risk-taking.


Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the On the Margin newsletter.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.

Tags

Upcoming Events

Salt Lake City, UT

MON - TUES, OCT. 7 - 8, 2024

Blockworks and Bankless in collaboration with buidlbox are excited to announce the second installment of the Permissionless Hackathon – taking place October 7-8 in Salt Lake City, Utah. We’ve partnered with buidlbox to bring together the brightest minds in crypto for […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Permissionless is a conference for founders, application developers, and users. Come meet the next generation of people building and using crypto.

recent research

Blinks Report Image.png

Research

Blinks enable the ability to vampire attack user monetization of existing networks by inserting onchain and financialized functionalities directly within the popular social feeds and digital experiences of today.

article-image

Kalshi founder Tarek Mansour said Thursday marked the “the first trade on regulated election markets in nearly a century”

article-image

I was excited about being on the precipice of realigning societal incentives and solving many issues plaguing our modern financial world

article-image

Cypherpunk Holdings has rebranded to Sol Strategies in a pivot to a Solana-first investment approach

article-image

BitGo’s wrapped bitcoin (wBTC) has a new custodial challenger

article-image

Make no mistake: Tether makes a ton of money. But exactly how much depends a lot on the price of bitcoin.

article-image

A new report on stablecoin activity in emerging markets shows their immense popularity in Nigeria