Bessie Liu

<div id="highlights-block_6345d9874d42c" class="highlights">
        <ul>
                <li>ParaSwap was alerted of the vulnerability early Tuesday by security firms</li>
                <li>The vulnerability, in a tool called Profanity, was exploited to drain $160 million from global crypto market maker Wintermute last month</li>
            </ul>
    
</div>



<p>Blockchain security infrastructure company BlockSec confirmed <a href="https://twitter.com/BlockSecTeam/status/1579769525247279104" target="_blank" rel="noreferrer noopener">on Twitter</a> that decentralized exchange aggregator ParaSwap’s deployer address was vulnerable to what’s become known as the Profanity vulnerability.</p>



<p>ParaSwap was first <a href="https://twitter.com/Supremacy_CA/status/1579742626961850368" target="_blank" rel="noreferrer noopener">alerted</a> of the vulnerability early Tuesday morning after Web3 ecosystem security team Supremacy Inc. learned that the deployer address was associated with multiple multi-signature wallets.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">1/ Hi <a href="https://twitter.com/paraswap?ref_src=twsrc%5Etfw">@paraswap</a> ,I heard that you want to see this? your deployer address private key may have been compromised (possibly due to Profanity vulnerability) and funds have been stolen on multiple chains.<a href="https://t.co/ijHaTwAj0l">https://t.co/ijHaTwAj0l</a></p>&mdash; Supremacy Inc. (@Supremacy_CA) <a href="https://twitter.com/Supremacy_CA/status/1579742626961850368?ref_src=twsrc%5Etfw">October 11, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>Profanity once was one of the most popular tools used to generate wallet addresses, but the project was abandoned due to <a href="https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c" target="_blank" rel="noreferrer noopener">fundamental security flaws</a>. </p>



<p>Most recently, global crypto market maker Wintermute was set back <a href="https://cms.blockworks.co/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability/" target="_blank" rel="noreferrer noopener">$160 million</a> due to a suspected Profanity bug.</p>



<p>A Supremacy Inc. developer, Zach — who didn’t provide his last name — told Blockworks that Profanity generated addresses are vulnerable to hacks because it uses weak random numbers to generate private keys.</p>



<p>“If these addresses initiate transactions on the chain, exploiters can recover their public keys through transactions and then obtain the private keys by continuously back-propelling collisions on the public keys,” Zach told Blockworks via Telegram on Tuesday.</p>



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"><p><strong>“There is one and only one solution [to this problem], which is to transfer the assets and change the wallet address immediately,” he said.</strong></p></blockquote>



<p>After looking into the incident, ParaSwap said that no vulnerabilities were found and denied that Profanity generated its deployer.</p>



<p>Although it is true that Profanity did not generate the deployer, BlockSec co-founder Andy Zhou told Blockworks that the tool that generated ParaSwap’s smart contract was still at risk of Profanity vulnerability.</p>



<p>“They didn’t realize they used a vulnerable tool to generate the address,” Zhou said. “The tool did not have enough randomness which made it possible to crack the private key address.”</p>



<p>Knowledge of the vulnerability has also been able to help BlockSec recover funds. This was true for DeFi protocols BabySwap and TransitSwap, which were both attacked on Oct. 1.</p>



<p>“We were able to retrieve the funds and return them to the protocols,” Zhou said.</p>



<p>After noticing that some attack transactions had been front run by a bot susceptible to Profanity vulnerability, BlockSec developers were able to effectively steal from the thieves.</p>



<p>Despite its popularity as an efficient tool for generating addresses, the developer of Profanity <a href="https://github.com/johguse/profanity" target="_blank" rel="noreferrer noopener">cautioned</a> on Github that wallet security is paramount. “The code will not receive any updates, and I&#8217;ve left it in an uncompilable state,” the developer wrote. “Use something else!”</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Get the news in your inbox. Explore Blockworks newsletters:</strong></p>



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown"><strong>The Breakdown</strong></a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch"><strong>0xResearch</strong></a>: Alpha in your inbox. Think like an analyst. </li>
</ul>


hack

The Bug That Took Down Wintermute Is Still at Large

Sam Martin

<div id="highlights-block_617725d07bf3f" class="highlights">
        <ul>
                <li>The Bitcoin Network has successfully implemented the highly anticipated Taproot upgrade</li>
                <li>Paraswap announced a new airdrop strategy in an attempt to out-smart &#8216;airdrop hunters&#8217;</li>
            </ul>
    
</div>



<p>Taproot is officially live as Bitcoin successfully underwent its largest upgrade in roughly four years. </p>



<p>The Bitcoin Lightning Network continues to expand its channel count, node count and liquidity. </p>



<p>Senators Lummis and Wyden propose a bill to clarify tax reporting requirements for industry players.  </p>



<p>Paraswap rolled out a retroactive airdrop of its token PSP, allocating 7.5% of the 2 billion token supply to early, active users.</p>



<p>NFTs are seeing a resurgence in volume to kick off the week. </p>



<h3 class="wp-block-heading"><strong>Latest in Macro:</strong></h3>



<ul class="wp-block-list"><li>S&amp;P 500: 4,682, +.00%</li><li>NASDAQ: 15,853, -.04%</li><li>Gold: $1,862, -.14%</li><li>WTI Crude Oil: $80.95, +.20%</li><li>10-Year Treasury: 1.625%, +.041%</li></ul>



<h3 class="wp-block-heading"><strong>Latest in Crypto:</strong></h3>



<ul class="wp-block-list"><li>BTC: $64,011, -.19%</li><li>ETH: $4,569, +.44%</li><li>ETH/BTC: .0716, +1.56%</li><li>BTC.D: 43.45%, -.57%</li></ul>



<h3 class="wp-block-heading">Taproot</h3>



<p>Yesterday, Bitcoin block 709,632 was processed and the <a href="https://cms.blockworks.co/anticipating-bitcoins-taproot-upgrade-heres-what-you-need-to-know/" target="_blank" rel="noreferrer noopener">Taproot upgrade</a> was activated. This is widely considered to be the largest update to Bitcoin in the past four years.</p>



<p>The Taproot upgrade enables Schnorr signatures, taproot and tapscript, according to a <a href="https://kraken.docsend.com/view/9e9y7may8526z934" target="_blank" rel="noreferrer noopener">Kraken Intelligence paper</a>. While users should not expect Ethereum-like smart contract capabilities, it is a big step that lays the ground work for innovation atop of the Bitcoin network.  </p>



<p>Noelle Acheson, Head of Market Insights at Genesis, noted the important enhancements in an email to Blockworks: </p>



<ul class="wp-block-list"><li>It will boost Bitcoin’s smart contract functionality, potentially broadening its use cases.</li><li>It increases privacy by obscuring what type of transaction is being executed.</li><li>Bitcoin transactions will become more data-efficient, which could optimize block capacity and lead to lower transaction fees.</li><li>Taproot&nbsp;makes transactions on the Lightning Network more flexible and more private, which should further boost Bitcoin adoption.</li></ul>



<p>A rough timeline of the Taproot upgrade from birth to implementation:</p>



<div class="wp-block-image"><figure class="aligncenter size-full"><img loading="lazy" decoding="async" width="750" height="609" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-3.01.24-PM.png" alt="" class="wp-image-11195" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-3.01.24-PM.png?w=750 750w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-3.01.24-PM.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-3.01.24-PM.png?w=317 317w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-3.01.24-PM.png?w=321 321w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-3.01.24-PM.png?w=270 270w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-3.01.24-PM.png?w=80 80w" sizes="auto, (max-width: 750px) 100vw, 750px" /><figcaption>Source: Kraken Intelligence</figcaption></figure></div>



<h3 class="wp-block-heading">The Lightning Network</h3>



<p>The Lightning Network (LN) is a protocol that enables high­-volume, low­-latency digital micropayments without the need for trusted intermediaries, according to the project&#8217;s <a href="https://lightning.network/lightning-network-technical-summary.pdf" target="_blank" rel="noreferrer noopener">website</a>. Using novel Bitcoin multi-signature transactions and scripts, Lightning participants do not give unilateral custody of funds to a third party, reducing transaction costs and counterparty risk.</p>



<p>Bitcoin node operators are able to download the Lightning Network daemon, fund their Lightning account, and begin opening channels in exchange for <a href="https://www.nasdaq.com/articles/how-to-operate-a-profitable-lightning-node-2021-03-01" target="_blank" rel="noreferrer noopener">some passive income</a>. </p>



<p><a href="https://defipulse.com/lightning-network" target="_blank" rel="noreferrer noopener">Defi Pulse</a> explains that because LN nodes (i.e., users in LN channels) are interconnected, nodes do not always need to open a direct channel with everyone they want to transact with. Payments can be routed through other channels, provided that a path with adequate liquidity exists between the two transacting nodes.</p>



<p>The Lightning Network has seen massive growth over the past year, with the total number of channels open <a href="https://1ml.com/statistics" target="_blank" rel="noreferrer noopener">crossing 80,000</a> and the amount of liquidity continuously reaching all-time highs. The more channels and liquidity in the LN, the more useful it becomes. Some of this growth is likely attributed to the <a href="https://cloudtweaks.com/2021/07/how-bitcoin-brought-lightning-network-el-salvador/" target="_blank" rel="noreferrer noopener">adoption of BTC as legal tender</a> in El Salvador. </p>



<div class="wp-block-image"><figure class="aligncenter size-full"><img loading="lazy" decoding="async" width="700" height="450" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Unknown-2.jpg" alt="" class="wp-image-11200" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Unknown-2.jpg?w=700 700w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Unknown-2.jpg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Unknown-2.jpg?w=400 400w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Unknown-2.jpg?w=406 406w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Unknown-2.jpg?w=341 341w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Unknown-2.jpg?w=80 80w" sizes="auto, (max-width: 700px) 100vw, 700px" /><figcaption>Source: lookintobitcoin.com</figcaption></figure></div>



<h3 class="wp-block-heading">Senators propose fix to crypto reporting laws</h3>



<p>Senators Wyden and Lummis introduced a bill to narrow some of the cryptocurrency tax reporting rules in the Infrastructure Bill being signed into law today, according to a <a href="https://www.bloomberg.com/news/articles/2021-11-15/senators-seek-crypto-reporting-fix-as-biden-signs-infrastructure?sref=uaUCx1z2" target="_blank" rel="noreferrer noopener">Bloomberg article</a>. The primary goal of the proposal is to ensure innovation is not stifled due to a lack of clarity around reporting requirements in the bill.</p>



<p>“Our bill makes clear that the new reporting requirements do not apply to individuals developing blockchain technology and wallets,” Wyden said in a statement. “This will protect American innovation while at the same time ensuring those who buy and sell cryptocurrency pay the taxes they already owe.”</p>



<p>Senator Lummis, a long-time supporter of Bitcoin, has been very vocal about her concerns related to government spending and its resulting inflation. She took to <a href="https://twitter.com/CynthiaMLummis/status/1458475839641763844?s=20" target="_blank" rel="noreferrer noopener">Twitter</a> to say &#8220;Bottom line: Inflation is a reflection of the debasement of US dollars by the federal government. New spending is at the root of the price increases at your grocery store.&#8221;</p>



<figure class="wp-block-image size-large"><img loading="lazy" decoding="async" width="1024" height="731" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/goldvinflationvbtc-1024x731.jpg" alt="" class="wp-image-11203" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/goldvinflationvbtc-1024x731.jpg?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/goldvinflationvbtc-1024x731.jpg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/goldvinflationvbtc-1024x731.jpg?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/goldvinflationvbtc-1024x731.jpg?w=1536 1536w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/goldvinflationvbtc-1024x731.jpg?w=360 360w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/goldvinflationvbtc-1024x731.jpg?w=366 366w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/goldvinflationvbtc-1024x731.jpg?w=307 307w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/goldvinflationvbtc-1024x731.jpg?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/goldvinflationvbtc-1024x731.jpg?w=2000 2000w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><figcaption>Source: Ycharts</figcaption></figure>



<p>Despite the successful implementation of Taproot, red-hot inflation numbers and a positive regulatory proposal, the BTC price has traded flat to negative over the last 24 hours. BTC was last hovering near $64,000, down roughly .5% on the day. </p>



<h3 class="wp-block-heading">Paraswap airdrop</h3>



<p>Paraswap, a decentralized exchange (DEX) aggregator that provides rates over multiple DEXs on the Ethereum blockchain, airdropped its token (PSP) to certain users this morning. Roughly 20,000 addresses were allocated 7.5% of the 2 billion PSP token supply. </p>



<p>The Paraswap team noticed a large amount of &#8216;airdrop hunters&#8217; and chose to select eligible recipients based on various usage metrics from a snapshot taken on Oct. 8, rather than airdropping tokens to every wallet that used Paraswap. Paraswap detailed its plan in a company released medium <a href="https://medium.com/paraswap/whats-an-active-user-clarifying-psp-token-distribution-filtering-logic-81df6096d410" target="_blank" rel="noreferrer noopener">article</a>, however, the airdrop led to confusion and discontent among users.</p>



<p>An overview of the PSP airdrop can be seen in the following photo:</p>



<div class="wp-block-image"><figure class="aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="492" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.41.33-PM-1024x492.png" alt="" class="wp-image-11188" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.41.33-PM-1024x492.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.41.33-PM-1024x492.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.41.33-PM-1024x492.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.41.33-PM-1024x492.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.41.33-PM-1024x492.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.41.33-PM-1024x492.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.41.33-PM-1024x492.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.41.33-PM-1024x492.png?w=1404 1404w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><figcaption>Source: Dune Analytics</figcaption></figure></div>



<h3 class="wp-block-heading">Non-Fungible Tokens (NFTs)</h3>



<p>NFTs are starting to see signs of life after a rough week last week. Bored Ape Yacht Club and its&#8217; Mutant derivative have seen a lot of attention today. Trading data from <a href="https://opensea.io/rankings" target="_blank" rel="noreferrer noopener">OpenSea</a> and <a href="https://solanalysis.com" target="_blank" rel="noreferrer noopener">Solanalysis</a> of some of the top Solana and Ethereum projects can be found below:</p>



<div class="wp-block-image"><figure class="aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="332" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.37-PM-1024x332.png" alt="" class="wp-image-11189" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.37-PM-1024x332.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.37-PM-1024x332.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.37-PM-1024x332.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.37-PM-1024x332.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.37-PM-1024x332.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.37-PM-1024x332.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.37-PM-1024x332.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.37-PM-1024x332.png?w=1238 1238w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><figcaption>Top Ethereum Projects</figcaption></figure></div>



<div class="wp-block-image"><figure class="aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="283" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.45-PM-1024x283.png" alt="" class="wp-image-11191" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.45-PM-1024x283.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.45-PM-1024x283.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.45-PM-1024x283.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.45-PM-1024x283.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.45-PM-1024x283.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.45-PM-1024x283.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.45-PM-1024x283.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2021/11/Screen-Shot-2021-11-15-at-2.42.45-PM-1024x283.png?w=1214 1214w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><figcaption>Top Solana Projects </figcaption></figure></div>



<p>If you made it this far, thanks for reading! I am looking forward to catching up tomorrow.</p>



<hr class="wp-block-separator"/>



<p><strong>Get the day’s top crypto news and insights delivered to your inbox every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.</strong></p>



<hr class="wp-block-separator"/>


Paraswap

Newsletter

Blockworks Research