Securing Liquid Staking: Lido’s Dual Governance Revolution | Tomer Ganor - Certora

excellent well thank you to our previous panel uh make web 3 great again um exciting talk coming up for you guys um please welcome toor ganner for from Sor he's going to be talking about securing liquid staking with Li's dual governance Revolution thank you thank you um okay so I'm here today to talk to you about uh cool bugs and issues I found during reviewing lios dual governance design H so let's start so who am i h I'm Tom Gano working Ator for two and a half years as a tech lead and security researcher I've audited a lot of liquid staking raking dexes Landing protocols and today we're going to talk about the biggest Lio H so Lio is the biggest Li withing protocol if you need to H to see what they are this the website but I'm sure everyone knows them and um and I've reviewed the design of Li of dual governance a year ago a design review is basically looking at the design before the code is even written which means that we can fix a lot of these issues and similar and other issues that that I found even before we started development and saving crucial development time time and a lot of money um after that we at Sor audited the Dual governance mechanism at September and then we re audited in January of course also formally verified H it h great so let's start with the the problem so the problem that we have and what want to solve H is that malicious Dows might want to steal all of the users assets and by passing a malicious proposal it just says I want to steal your assets and then the stakers or deposit of the protocol have a problem they need to leave and fast so usually we have two mechanisms that help us to prevent this from happening the first one is Guardian multi which after the bite bit hack I think we all know that it's not very H we can't trust them with 100% certainty because they might not work as expected so we need to avoid counting them fully also we have time loocks so time locks works for other Dows for example for dexes and Landing protocols because you can immediately withdraw your funds after you saw the malicious proposal that's stealing all of your funds away which means that if we have a time look of three days 5 days maybe a week depending on which protocol we're looking at a week is enough three days are enough to withdraw your funds because they are liquid but in Lio like other liquid St and protocols this is not the case because the withdrawal mechanism of ethereum has a very a variety of withdraw times it might be days or it might be even month months which is very very problematic if you have any malicious proposal they want to steal all of your e you want not be able to withdraw it in time which means that we have a proposal that says I want to se all of the E and then you try to withdraw it takes like one month and then the proposal execute in 3 days and your money is already gone so that's of course the the problem we want to solve and we need a dynamic time lock to do it so let's see how Li's initial design looked so first we have the D the da just votes like any other da on a proposal once the proposals have passed we submit it you see the sub and execute there so we submit it to the Dual governance mechanism which means that now the time lock of 3 days starts after the three days ends then we can execute the proposal this is the state in 99% of the cases this is a regular State the like any other D what's H new here is now we have another state which is the V down state inside of the V cooldown State we need to be in this state for 24 hours and this state we can only execute and not submit anything which means that if there are previously submitted proposals that exist we can execute them otherwise we cannot submit anything new but the state only last for 24 hours which is not that long also just a reminder all of the numbers I'm saying the 3 days for the time Lo the 24 hours different numbers I'm going to say right now they're only temporary numbers for now until Li do da approve everything which means they might change for example the F cool down duration was 24 hours and now it's 6 hours it's the same ballpark but it's not exactly the same numbers because the Dow might change the numbers before they approve it so let's continue the most interesting state is this state the VTO signaling state so as you can see in the VTO signaling State we can only submit and we cannot execute which means that if there is a malicious proposal is going to steal all of our funds once we get in this state they cannot execute it which means that even if the three days have passed we still are safe from malicious da H theft H how do we get into the state we need to lock 1% of s which is $300 million which is a lot I know into the Esco contract and then once we reach this threshold we transfer into this state and in it h we need to continue uh continue depositing more and more and more until we reach a threshold of 10% of s after 45 days H and and if we fail to do it then we revert to the deactivation phase the deactivation phase is a temporary phase very short 24 hours in length and we cannot submit an execute during that I'm sure the not execution part is very clear otherwise the malicious D can just steal all of our funds which is bad of course and the anti- submit part is there to allow the stakers s to deescalate the situation maybe the da wants to explain to the stakers oh there is a misunderstanding everything is okay you misunderstood the proposal and then H we want to allow them to unlock their funds or to not lock more funds to continue supporting the VTO singling and then after 24 hours if the stakers are convinced that the proposal is not malicious or not cannot convince enough other people to deposit more funds then we transfer to the Vita cool down which means that now we can EX proposal everything is okay and for 2 for 24 hours in the initial design and then we can go back to the normal or to continue the protocol if we do are able to get to 45 days and 10% of the funds which is $3 billion which is of course a lot a lot of money then after 45 days we reach to the rrit state the rrit state like the VTO sink state is the same we cannot execute to not to to prevent the theft of the funds from the users but we can submit once we reach this state it's very simple we transfer all of the funds of the stakers to the withdrawal queue and request to withdraw him from the Bon chain bon bon layer which means that we're waiting maybe days maybe weeks until the funds come back then we distribute them to the stakers until then we stay in this state only once the funds return to the stakers then we transfer back to either normal state if everything is fine or to the V signaling state if there is another malicious proposal they want that that wants to be executed because the da submitted it all of the stakers that didn't join the initial ra V sign rage git and then let's say we went to the normal State they cannot complain even if there is a malicious proposal that exist because we were at VTO signaling and they had 45 days to join if they didn't join then R quit happens and then they're sort of they cannot blame Lio they can't blame anyone because they should have joined and they cannot complain so let's see what can break here so first we have The Flash run attack so what is The Flash run attack the flash R attack starts in normal State and we have of course a flash on provider H the attacker flash loans enough funds H from the flashh on provider to lock inside of the escrow and Trigger the VTO singal link State at this point in time the their threshold of 1% or uh 1% is met so we transfer to the VTO singal state in which we can only submit cannot execute then because it's a fles on we need to repay fast right which means that we need to unlock the funds and transfer back transfer them back to the FL Provider by doing so we uh transition to the deactivation phase in this phase as you can see there there is no submission and no execution but don't worry it's only for 24 hours right after 24 hours everything go go back to usel so wrong wrong because we can do it again before the 24 hours have passed we can again take the flash Stone lock the font inside of the escrow which means that again we refresh the clock for the deactivation to 24 hours starts again soon so next time we be in the deactivation the 24 hours starts again now we're in the v signaling and and we again sorry we again unlock our funds transfer back to the deactivation state with a new 24 hours clock we repay the flash loan and wait again so this Loop can be done continuously again and again and again by flesh loaning locking unlocking and repayment if we do it once every 24 hours the system stays in the activation continuously which means that there is no submissions and no executions at all but after 45 days that unfortunately for the attacker he cannot R quit the funds and and make the system to wait more because those funds are getting locked in the withraw queue which means that they cannot unlock them and return it and return the flash loans so everything is okay right right so not not so sure it's not that fast because once we go to the activation we transfer to the V cool down in the v done we can execute so everything should be okay but the problem is because we are continuously for 45 days straight inside of the deactivation State we couldn't submit anything during this state which means that there is no submissions happening even during the deactivation and during the VTO cool down which means that even if we want Ed and we can execute something but we have nothing to execute which means that now if we do it continuously forever this entire H iteration we will be forever in deactivation for 45 days then in V cool down for 24 hours and then again the activation 45 days with a cool down for 24 hours which means that we are we can never submit anything and the Dow is stuck forever so that's of course very bad and and just a reminder that the attacker didn't need to have any funds to do it so he can just flash on everything so no money and and you can just make the Dual governance to be stuck forever that's of course a big problem so there is a small white Hack That H Lio or some uh white hat can do to try to help the system in this design it's not solve everything but it's small Improvement so what the white can do is be like a hacker he can take a flashh loan and lock it so during the deactivation we take a flash Zone we lock the funds by doing that we are transferring to the VTO singaling state in which reminder we can submit we cannot execute but we can submit this is a very important part because now we can submit the proposal that da wanted and the problem before reminder it was that we have no submissions we have an execution period but we have no submissions so now we can sort of enable the submission to happen and then of course like we submit and then we of course need to unlock and then return the fles Lo but once we did this H we are able to submit proposals there is still the problem in which an attacker with zero funds can make the system to be delayed for 45 days H from the point of submission to the point of execution instead of three days which is of course only if the user had this amount of a lot of funds 10% three billion dollar of s only then you should be allowed to delay the system and even then we still had to attack the system to make it operate partially of course that's very bad so how do we solve this so wait again okay now okay so the first the solution is just add a minimum time block a minimum time block is very very simple whenever you lock funds you cannot unlock them immediately let's say you wait for an hour and then you can unlock it so that's all everything right there is no more fles loans the problem is solved right wrong so for the first for this first idea it doesn't work for the following reason we have this scenario let's say we are in the deactivation maybe we start in normal State it's the same once we are in the deactivation or normal what the attacker can do is first and the attacker here needs to have the funds so no flash for him if the attacker is very rich he can do the following Lo half of the funds initially before the attack and wait for the the one hour that he wanted and that he needed because of this new addition that we added after the 1 hour that we wait attacker uses the same the the same fund like another amount of the the same amount of funds but from a different address so the second half of the funds but from a different address so that it doesn't mess up the initial time lock and lock again the second half now once we lock the entire amount of funds needed to trigger the V signaling we transfer back from the activation to V signaling and now because the first address of the attacker not the second the second one is stuck he stck for an hour right but the first address because he waited as you see there it just goes and it can draw the first half of funds by R drawing the first half of funds there are not enough funds in the in the escrow to support the V signaling at this point which means that now again the 24-hour clock refreshes so we can do it of course continuously which means that we have the same attack as before but now we need to be rich to do it but we don't want even to allow a rich user to be able to make the system to get stuck and you need to attack the system to make the system work so that this solution is partial so how do we solve this problem in full with another VTO signaling minimum duration the VTO signaling minimum duration is 5our duration in which after we enter the V signaling phase we stay there for 5 hours even if the funds are not there which means that the attack from before where we entered by locking new funds and then immediately unlocking to revert to the deactivation phase again that won't happen here because now we we'll be in the deactivation in the v sign phase for 5 hours before we transfer to the deactivation phase which means that now even if we try to do all of the complex attack I just described we still allow the submissions to happen we still allow the execution to happen which means that the attacker just have the regular power that he has by Design if you are very very rich you have $3 billion in a you can delay the system for 45 days that is like this is your right but you cannot make the system to not be able to submit uh submit proposals or make them H with zero money um delay the system so this is the first issue uh that I found and the second issue that I found is um the Dos Loop to the Dual governance so what is a Dos Loop it means that let's just focus on the important uh part so in these two states you can see there is no execution between those two sakes which means that doing video signaling and doing R to protect the users we are not allowing the Dow to execute anything but as you see we might be able to Loop between them forever V in RIT VTO signaling RIT forever and then the system is stuck of course so why do we want to allow this so maybe we are able to limit the number of of iterations between VTO single and great Tre let's say some a final number n of iterations from Ving reg then after that we are not allowing this to be a non execution state so how do we H why why do we need this H why need to allow this so let's see what if we limit the number of iterations so in this what if um case we start with a normal State then attacker comes with money from that his own money and lock it inside of the escrow then we need to wait the 45 days as before like we have 10% 45 days great and then we have the r crit doing the doing R crit we transfer the funds of course to the withdrawal que we have to wait for who knows how long some length of time maybe a week maybe more and then we get the funds back and the attacker is happy now for the second time notice this is the same R crit as as before as here it's the same R crit so and the second time we are in the red Street then the attacker again locks the funds going to VTO singaling waits for the 45 days and then again transfer to R crit and again we're on the withdrawal queue wait the the amount of time necessary week month three days maybe who knows and then we get the funds back so we do it again and again and again continuously and then on the end time which is the last time we allow it by design by this what if design we again lock the funds wait the time get the r quit transfer the funds to withdraw que and wait again the time and get the funds back so now we did it so the maximum amount of time we were allowed then what happens is that the Dow can now submit whatever proposal he wants during this entire phase of um and this the last iteration of the h v signaling R Loop and then the Dow can now execute it because we cannot prevent it we cannot veto signal again because we limit it to some final number n which means that the Dow can maliciously create this Loop and exhaust all of the supply of n times in AOW that we allow and then he can do whatever he want and steal all of the funds from the users or like break the break the protocol completely so this is why we cannot use this what if um design to have a final number of it of Loops so we are have to use this infinite number of of Loops to allow it so why so is everything broken so not so fast I li to you a bit this the design is not that simple it's not just four states and that's it we have this design which is very very nice very very complex don't worry we only look at this part which with the tiebreaker committee and the Dual governance there so let's zoom in and see how it solve the LI to solve this problem so if we have this Loop of V signaling red quit V red visting redit now once a year that throughout the entire year we have no execution state which means only those two states only V signaling and rage quit no normal State no V cool down once a year we can call the tab committee through a multisig which is not related to a DA so now we have a multi which is a um we allow it to have some power but only on strict condition only once a year only if there was no other options to execute and only then we allow it to execute something the D already approved so it's a very very weak component but it's still enough to save us from being stuck forever so once a year we can allow it to execute the proposal even though the Dual governance doesn't allow it which means that we can bypass the Dual governance mechanism on certain conditions for example we have H the once a year and also H the only non execute okay great so now we have the H now what is the problem with this we have the V singling r r of course now once the here what we do we go to the normal State instead of going back to VTO signaling and immediately going to the VTO signaling uh State this is breaks the streak of non-execution states which means that we are um we are not allowed to to call sorry we are not allowed to call to the tiebreaker committee to help us to execute proposals because we were transitioning to a Midstate of normal state which means that now the streak is broken and we could have executed but we haven't great so how do we solve this the of course we can do it forever how do we solve this this is the initial design and the new design is this design which me now if we are in a row completely in a row of Ving and R states where non-execution we are forced either to wait a year there and then we can uh and then we can execute through the tbre committee or we are forced to move to the VTO cool down and once we end the V cool down we can execute again great everything is solved so um I have a blog post on this in our website it about this design review also we can check out the full design H for Lio H from the G repo H very interesting H thank you very much Le team this project have been very very interesting very Innovation Innovation Innovative and um so feel free to join us to our party tonight I'll be there and this is my contact if you have any questions feel free to ask I would love to answer thank you