Security in web3: a series of unfortunate events - Bianca Buzea

[Music] foreign thank you [Music] foreign foreign [Music] ER I'm about to say that the presentation you're about to view it's extremely unpleasant it tells an unhappy tale about several hacks that occurred across defy and C5 platforms even though web free offers the potential for increased Financial inclusion and decentralization it has also been plagued by malicious actors who have exploited vulnerabilities to still funds from the very beginning of this presentation when we discussed the first hack to make headlines continuing on for the entire discussion the Specter of danger Larks one might say that blockchain platforms are magnets for Misfortune in this short presentation we will cover gradient repulsive investors and Founders vulnerable smart contracts security breaches and plots to steals users funds it is my sad duty to delve into these unpleasant Tales to seek Solutions and Redemption where it can be found but there is nothing stopping you from leaving the presentation and focusing on something more uplifting if you prefer that sort of thing with all due respect Bianca Busia hello everyone I hope you enjoy Lemony Snicket as much as I do because in this presentation we're gonna be looking at A Series of Unfortunate Events so a bit about myself my name is Bianca Busia I'm the developer relations engineer supporting balancer and today I decided to talk about this series of unfortunate events especially in the lights of what happened in 2022 now it's the perfect moment to learn some lessons and to make sure that we don't have the same thing happening in the future so this is a brief outline of what we'll be covering we're gonna start all the way back from the Dow hack then we're gonna look at the question whether code is Law and then we're gonna come back to the near present we're gonna look in 2022 to the teradipeg and the FTX incident and based on those we're gonna look at what are some lessons that we can learn so there we go uh the dial overview so the Dao was launched in 2016 as a decentralized autonomous organization and it was designed to act as an investor director directed The Venture Capital firm uh it managed to raise a large amounts of fund uh there were 12.7 million Eid which at the time of the hack were worth 250 million USD dollars now let's look a bit at the timeline of the events that happened so the ethereum Genesis block happened in July 13th in 2015 and one year later was the Inception of the Dao by slocity in 2016. from the beginning there were a couple of voices concerned about potential vulnerabilities with the Dao however the crowdfunding process continued therefore in June 2016 there were 250 million USD dollars the equivalent in USD dollars later in June 70 million of it have been drained using re-entrancy attack we're gonna cover what is re-entrancy both in Computing but also when it comes to Smart contracts so at this point the ethereum community had to make a difficult Choice basically they had two options either to do nothing and to act accordingly to the Eaters of Cody's law or to take action and to save the funds initially a soft Fork was proposed by vitalik however it was discovered that the soft Fork was vulnerable and therefore in June 20 the ethereum Hartford was announced basically to roll back the history of the blockchain now as I promised we're gonna look at re-entrancy first we're gonna look what is reference in general in Computing so a procedure is reentrant if it can be interrupted in the middle of its execution and then it can be safely restored and this is very useful because it allows to sing all Global changes and also because it doesn't allow to change variables outside its own scope this is again useful if you want if you have multiple threads if you have parallelization but when it comes to Smart contracts you don't want to have re-entrance so now we're at the look of uh re-entrancy flow how does it happen I I'm gonna exemplify here with the basic example uh with some simple numbers but the same Concepts and the same flow applies for the Dao hack so you have a vulnerable smart contract that stores some eat let's say we have 1080 in this smart contract then the attacker deposits one eat the attacker calls the withdrawal function in order to send that it to the receiver which is the malicious uh contract then the withdrawal function checks whether the user has one eat and indeed the user has one it they just deposited that but now the malicious contract fallbacks cause withdrawal again and the problem is that the balance of the user has not been updated therefore it can withdraw more heat even though it doesn't have more it has only one eat so you can see how by repeating this process in a loop the malicious uh smart contract the attacker can withdraw all the eat and empty uh the vulnerable smart contract so here it's a diagram that basically describes what I just explained so in the case of the doll hack we had like two contracts we can assume a contract B which is the attacker and the contract a uh the vulnerable uh smart contract and the contract B the attacker basically interrupts the contract a before it finishes updating uh its own balance so this is the re-entracy now going back to our Fork after the hard Fork there resulted in two chains ethereum and ethereum classic and those who refuse to accept the hard work that roll back the blockchain basically supported uh ethereum classic so now again this raises the question whether code is law so we have two camps here those that think that it is good that we were able to erase successfully a cyber theft and the other camp that believes that blockchain should be immutable no matter what so the second camp that believes in blockchain immutability are the ethereum classic proponents and they believe in the at ethos of code is King nevertheless most of the communities agree that in this case user safety was more important and that's the version of ether that we have today now we're gonna look at the Terra Luna crash we're gonna go all the way uh until 2022 so here you can see how uh Luna from one of the top coins in terms of market cap fell to a couple of cents in two months so what happened the Terra USD stablecoin and the governance token Luna collapsed and there was one triggering event anchor protocol where most of the USD was blocked 72 to be precise they announced that they're gonna decrease their interest rate and because of that when people realize that the 20 interest rate is not sustainable they decided to leave the system and this is the what happened uh via the burn and more meeting mechanism they started to leave the system however that had an impact on the Luna because a lot of the people were trying to exit at the same time so here is a diagram that basically shows the whole process so we start with one triggering action uh the anchor protocol reducing the interest rates then the USD holders start to withdraw and they have to exit options the first one is via an uh mint and burn mechanism and because everyone is uh minting and burning at the same time the network becomes very congested the the fees uh the gas fees are very high and this of course has a negative impact on the price of Luna the other exit mechanism is to swap on different amms and there the pool becomes unbalanced so both of these mechanisms basically have as a consequence the deepeg and the d-peg itself costs more people to panic and by people panicking more people want to withdraw and you can see that there is a whole Loop in here so again to summarize this there is like one panic uh one uh triggering event then there is the burn uh USD for uh Luna then the Luna supplies uh increases which of course as a result makes the lunar price to drop and these as a consequence makes the USD to start losing its Peg which causes more panic now let's look of the FDX incident this is quite similar so this also happened with one triggering action in November the second there was an article that basically announced about the alameda's FDT positions then after that article was released binance announced that it wants to liquidate its ftt position [Music] later the FTX seeked the bailout from binance and VCS in initially minor said that it will buy out all the non-us businesses however after some due diligence they stepped out of that on the 10th of November the Bahamas freezes the FDX assets then SBF steps down as a CEO uh then on November 15 the FDA stopped withdrawals and then the Bahamas sees assets and we all know the story what happens next so you might remember this diagram this is basically the same diagram as before however you might see there are two more elements so the same Panic element from before basically made balance to Once to the risk and to liquidate its ftt position so actually there is a connection between the Terra Luna crash and the FTX incident so we see here the same Loop the Panic there's some sort of panic there there is a large withdrawal and then there is loss of liquidity this is the common factor so what's happening out there is that these systems are strongly coupled and one triggering action has a whole domino effect here I put back to back the two diagrams the one from the re-entrancy and the kilo Loop for Terra Luna and FDX for the re-entracy one since the dial hack were in a very good position we took a lot of measures and guard rails to make sure that this thing don't happen again we have strong auditing we have bug bounties uh there is we are in a good position however this is not enough now we need to address the second part and to do that we need to continue to value decentralization and we need to decouple the system we need to decouple any economic systems and to do that we need to expand the community to decentralize control and we need education that was it for me thank you very much [Music]