Audit reports

All Case Studies

Case Studies

About

Careers

Brand Assets

Invest

Company

Audits 

Services

Mitigate weaknesses in your smart contract and improve its functionality with a double line-to-line code analysis and a separate review by a lead auditor.

Secure the entire architecture and implementation layers of your blockchain protocol with professional security audits and testing.

Proactively detect vulnerabilities in your Web3 project by subjecting your systems to a simulated cyberattack in a secure and controlled environment.

Identify vulnerabilities in applications interacting with blockchain networks with secure code review and static security analysis.

Code review & static security analysis for crypto wallet apps.

Code review & security analysis for cross-chain crypto bridges.

Receive only relevant bug reports or undergo crowdsourced penetration testing with the help of thousands of ethical hackers curated by HackenProof.

Enhance transparency in crypto exchanges with independent on-chain proof of assets’ true collateralization.

Assess and strengthen your security practices, identify vulnerabilities, and safeguard valuable digital assets in the ever-evolving cryptocurrency landscape.

Ensure your token model robustness and efficiency and convey trust to investors and community with our thorough, independent audit of protocol economic security.

Solutions

Featured ecosystems

By Languages

Blog

Company 

Discover

Insights

Industry news

Network

Hacken news

Resources

Smart Contract Audit

Blockchain Protocol Audit 

Blockchain Penetration Testing

dApp Audit

Cross-Chain Bridge Audit

Crypto Wallet Audit

Bug Bounty

Proof of Reserves Audit

Solidity

Rust

Move

Solana

Near

Polkadot 

Cosmos 

Optimism

Ethereum (EVM) 

Avalanche

Fantom

Polygon

Aptos

zkSync

Arbitrum

Radix

Linea

MetaMask

Smart Contract Audit Solutions

Terms and Conditions 

Privacy Policy

<p>On Jan. 30, there was a significant security <a href="https://twitter.com/zachxbt/status/1752694489905528943">alert</a> at <a href="https://ripple.com/">Ripple</a>. About 213 million XRP tokens, worth roughly $112.5 million, were illicitly siphoned off from wallets believed to be associated with Chris Larsen, Ripple's Co-founder &amp; Executive Chairman.</p>



<h2 class="wp-block-heading">Ripple Incident Update</h2>



<p>Our investigation into this event reveals a tangled web of transactions linking back to XRP's core operations. Our researchers, led by Dmytro Yasmanovych, identified key wallets, a pivotal $64 million transaction, and connections to a Kraken exchange address, hinting at a complex scheme beyond initial appearances.&nbsp;</p>



<p><a href="https://twitter.com/hackenclub/status/1755246957201678670"><strong>Check out our concise thread on X to learn more about the intricacies of this scheme</strong></a>.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
https://twitter.com/hackenclub/status/1755246957201678670
</div></figure>



<h2 class="wp-block-heading">Initial Breach Overview</h2>



<p>The core of the incident revolves around the source address <code>rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm</code>, initially linked to Ripple. From this wallet, substantial amounts of XRP were diverted to multiple addresses, including but not limited to:</p>



<ul>
<li><code>rGhR13XyM43WdDaSMznHd5rZ4cJatybvEg</code></li>



<li><code>rHQVKntyfkDCPhEBL2ctryuEAkDZgckmmV</code></li>



<li><code>rLsUemhuBZtF44rqqzneb2F9JgyrRYYd4t</code></li>



<li><code>rKPERax7t9iFvT3RHXn5nifyNpzp9a4hBa</code></li>



<li><code>rpjs4HLX1gJoEenH69PsQmXaXY22QhCYAT</code></li>



<li>...and several others.</li>
</ul>



<p>Subsequently, the attacker embarked on a complex laundering scheme, moving the stolen funds through various centralized exchanges, such as Binance, OKX, HTX, MEXC, Gate, and Kraken. The liquidity of these platforms potentially facilitated the swapping and withdrawal of the large sum of tokens involved.</p>



<h2 class="wp-block-heading">The Twist: A High-Profile Target</h2>



<p>The incident unfolded with a shift in focus from an assumed Ripple system breach to targeting a personal wallet belonging to <a href="https://x.com/chrislarsensf/status/1752702297971532258?s=20">Chris Larsen</a>, Ripple's Co-founder &amp; Executive Chairman. Adding a twist, the involved wallet, rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm, was initially identified in block explorers like XRPScan and Bithomp as <a href="https://twitter.com/zachxbt/status/1752853358602494181?s=20">connected to Ripple</a>. However, it was later updated to reflect its association with Larsen, bringing an additional layer of intrigue to the situation.</p>



<p>It's suspected that compromised private keys were the weak spot exploited by the hacker.</p>



<p>In response to the breach, Chris Larsen reassured the community, stating, “This is an isolated incident, and Ripple wallets are secure/were never compromised. We’ve confirmed nearly all the affected funds were converted out of XRP.”&nbsp;</p>



<figure class="wp-block-image"><img src="https://lh7-us.googleusercontent.com/YTpmiGpwqsJyAupQhCk367lSQ-zNh80IhKSimXrBvkFPCxuL3G7a_iRMFAV4IOCG_hLXLC1Njy_0nU8ZEDzsv1L5vKwRAw8GP_5Kqzb2QeoI-cIkmH26WNbDaQtpPChzC89Vc37_nI4snbs05kCk4qg" alt=""/></figure>



<p>Larsen’s proactive stance, coupled with Ripple's collaboration with law enforcement and blockchain analytics firms, highlights the swift and effective measures taken. Reports suggest a significant portion of the stolen funds has been frozen, with relentless efforts underway to recover the remainder.</p>



<h2 class="wp-block-heading">A Ripple in the Community</h2>



<p>The incident spotlights the crucial importance of stringent <a href="https://hacken.io/discover/wallet-security/">security practices for individual wallet holders</a>, especially high-profile figures in the crypto space. It serves as a stark reminder that the vigilance of organizations must extend beyond their enterprise systems to encompass personal assets linked to their ecosystem.</p>



<h3 class="wp-block-heading">Lessons Reaffirmed:</h3>



<p><strong>Enhanced Personal Security:</strong> Individuals, particularly those with substantial holdings, must employ robust security measures for their private keys and wallets.</p>



<p><strong>Vigilant Monitoring:</strong> Continuous monitoring of wallet activities can help in the early detection and response to unauthorized transactions.</p>



<p><strong>Collaborative Recovery Efforts:</strong> The incident underscores the effectiveness of timely collaboration between affected parties, security firms, and law enforcement in mitigating the aftermath of a breach.</p>



<p>As this event develops, Ripple's immediate action and the community's strong response highlight their strength in navigating the complex and sometimes uncertain crypto landscape. This incident reminds us of the constant need for strict security with digital assets and showcases the crypto community's unity and determination in tackling such challenges directly.</p>

Ripple Hack Explained: A Deep Dive into the Recent XRP Heist

<p>In a startling turn of events, the Web3 community was shaken by a significant security breach. Users of popular dApps like SushiSwap, Zapper.fi, and RevokeCash reported suspicious activities, signaling a potential compromise in a widely-used Web3 connector. This breach serves as a stark reminder of the ever-present <a href="https://hacken.io/discover/defi-security/">vulnerabilities in the DeFi space</a>.</p>



<h2 class="wp-block-heading">Inside the Attack</h2>



<p>The heart of the issue lay in the Ledger Connect Kit library (<a href="https://www.npmjs.com/package/@ledgerhq/connect-kit/v/1.1.7">Ledger Connect Kit v1.1.7</a>). Ledger, a prominent player in digital asset security, confirmed that this library was indeed compromised.&nbsp;</p>



<p>The attackers injected malicious code into the library, transforming it into a 'drainer' that targeted users' wallets. It was possible as a result of a phishing attack targeting the former employee's npmJS account. This code affected every website utilizing the library, instigating widespread panic among users. </p>



<p>The drainer operated by siphoning funds from wallets, but only after users inadvertently granted approvals to the malicious smart contract. Thus, merely visiting an infected site did not pose an immediate threat. However, once approvals were given, the funds were swiftly drained to two primary wallets:&nbsp;</p>



<p><em>0x412f10aad96fd78da6736387e2c84931ac20313f</em> and <em>0x658729879fca881d9526480b82ae00efc54b5c2d</em>, with over $850,000 being stolen in just a few hours.</p>



<blockquote class="twitter-tweet"><p lang="en" dir="ltr">❗️<a href="https://twitter.com/SushiSwap?ref_src=twsrc%5Etfw">@SushiSwap</a>, <a href="https://twitter.com/zapper_fi?ref_src=twsrc%5Etfw">@zapper_fi</a> and <a href="https://twitter.com/RevokeCash?ref_src=twsrc%5Etfw">@RevokeCash</a> front-ends are compromised!<br><br>Stay safe and do not interact with this platform!<br><br>🧵All updates will be posted below...</p>&mdash; Hacken🇺🇦 (@hackenclub) <a href="https://twitter.com/hackenclub/status/1735279162187772341?ref_src=twsrc%5Etfw">December 14, 2023</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>



<h2 class="wp-block-heading">Lessons Learned</h2>



<p><strong>Rigorous Code Auditing</strong>: Regular and thorough audits of third-party libraries are essential.</p>



<p><strong>Check Access:</strong> Regularly check and revoke access, especially for former employees.</p>



<p><strong>User Awareness</strong>: Users must understand the approvals they grant on dApps.</p>



<p><strong>Rapid Response</strong>: The need for quick action in the face of security breaches cannot be overstated.</p>



<p><strong>Diversified Asset Allocation</strong>: Avoid storing significant funds in a single asset or platform.</p>



<p><strong>Clear Communication</strong>: Ensuring timely and transparent communication with users during crises is crucial.</p>



<h2 class="wp-block-heading">Conclusion</h2>



<p>The swift <a href="https://x.com/Ledger/status/1735370531224834430?s=20">action by Ledger</a> to rectify the issue and <a href="https://x.com/paoloardoino/status/1735315976827101274?s=20">Tether's freezing</a> of the attacker's wallet highlight the resilience of the Web3 community. However, this incident reminds us how important it is to always be alert and to keep learning about digital assets. As we go forward, we should all work together to strengthen our security, stay up-to-date, and carefully make our way through the ever-changing world of Web3 with a better understanding of how to stay safe.</p>

Understanding the Recent Hack on Ledger Connect Kit

<p>KyberSwap, a multi-chain DEX aggregator, fell victim to a smart contract reentrancy attack on November 23, 2023. The exploit led to a loss of approximately $47 million across multiple networks and a 90% drop in TVL.</p>



<p>Let’s take a closer look.</p>



<h2 class="wp-block-heading">Inside the Attack</h2>



<h4 class="wp-block-heading">Exploiter Wallet</h4>



<ul>
<li><strong>Address</strong>:<a href="https://etherscan.io/address/0xc9b826bad20872eb29f9b1d8af4befe8460b50c6"> 0xc9b826bad20872eb29f9b1d8af4befe8460b50c6</a></li>



<li><strong>Role</strong>: Central node in the attack, receiving and redistributing the stolen funds.</li>
</ul>



<h4 class="wp-block-heading">Key Transactions</h4>



<ul>
<li><a href="https://etherscan.io/tx/0x396a83df7361519416a6dc960d394e689dd0f158095cbc6a6c387640716f5475">Ethereum Network Transaction</a></li>



<li><a href="https://polygonscan.com/tx/0xb58c81460ef0167f492fb4900e9da60cc6fa1117bd5b67b2100bb5b5e5df8b0c">Polygon Network Transaction</a></li>
</ul>



<h4 class="wp-block-heading">Attack Impact Across Networks</h4>



<ul>
<li><strong>Arbitrum</strong>: $20M</li>



<li><strong>Optimism</strong>: $15M</li>



<li><strong>Kyber Mainnet</strong>: $7.5M</li>



<li><strong>Polygon</strong>: $2M</li>



<li><strong>Base</strong>: $315K</li>
</ul>



<p>Total Value Locked dropped 90% from $84.9M to $8.28M million on the day of the hack, which exemplifies the profound impact of <a href="https://hacken.io/discover/smart-contract-vulnerabilities/">smart contract vulnerabilities</a>. Initially, the exploit led to the direct loss of $49M. Subsequently, KyberNetwork’s recommendation resulted in an additional $27M being withdrawn by users.</p>



<h3 class="wp-block-heading"><img src="https://lh7-us.googleusercontent.com/V8Ux8O2iEz2XNyB1m0kWlFUxyZPiPT5C6tywj3b0QY2_D2qiqkAGciHDJEePlQg_MAb63fDr_HBCrZMTQg58cZnsTn1fYZzq0XpCEJ-w0P2E2U66XFmuFG0-8zLQHw5xrhYJ7xcrmrMQiOQ5XkV1lqU" width="624" height="276"></h3>



<h3 class="wp-block-heading">The Flaw: Reentrancy in the Mint Function</h3>



<p>The core of the exploit was most likely a vulnerability in the mint function of KyberSwap's new v2 reinvestment token (KS2-RT). This implementation contained some sort of mint callback, which might have created a loophole for <a href="https://hacken.io/discover/reentrancy-attacks/">reentrancy attacks</a>.</p>



<h4 class="wp-block-heading">Vulnerable Contract</h4>



<ul>
<li><strong>KS2-RT</strong>:<a href="https://etherscan.io/token/0xcbec1e9407f1910c86f261eaeac27d85c0479e8c"> Smart Contract Tracker</a></li>
</ul>



<p>Note: If other KyberSwap forks aren't implementing this v2 reinvestment schema, they are probably not vulnerable.</p>



<h3 class="wp-block-heading">Kyber Network's Response</h3>



<p>Kyber Network, in a swift reaction to the breach, issued an urgent advisory to users, urging them to withdraw their funds as a precautionary measure. The team is actively investigating the incident to understand its full scope and implement necessary security measures.</p>



<h2 class="wp-block-heading">Lessons Learned: Securing DEXs</h2>



<p>This incident underscores the need for rigorous security protocols in DeFi platforms, particularly in the management and implementation of smart contracts. The reentrancy vulnerability exploited in this case highlights the critical importance of:</p>



<ol>
<li><strong>Thorough Auditing</strong>: Regular and comprehensive <a href="https://hacken.io/services/blockchain-security/smart-contract-security-audit/">smart contract audits</a> to identify potential vulnerabilities, especially when upgrading functions.</li>



<li><strong>Real-Time Monitoring</strong>: <a href="https://extractor.hacken.io/">Continuous monitoring</a> of network activity to detect and respond to suspicious transactions.</li>



<li><strong>Best Practices in Development</strong>: Adherence to secure coding practices and learning from past incidents to prevent similar exploits.</li>
</ol>





<h2 class="wp-block-heading">Conclusion: Fortifying DeFi's Future</h2>



<p>The KyberSwap attack serves as a reminder of the constant threats in the DeFi ecosystem. As we navigate this dynamic landscape, it's imperative for all stakeholders to adopt a security-first approach, continuously enhancing their defenses against sophisticated exploits. This proactive stance is crucial in maintaining trust and stability in the world of decentralized finance.</p>



<p>Stay updated with the latest in blockchain security.</p>

KyberSwap's $47M Reentrancy Attack: A Deep Dive into the Exploit

<p>The DeFi world was shaken by a sophisticated exploit targeting the Heco chain bridge, resulting in a loss of $87 million. The attack didn't stop there; HTX's hot wallets were also compromised, leading to an additional $12 million theft.</p>



<h2 class="wp-block-heading">Inside The Attack</h2>



<p>The <a href="https://twitter.com/hackenclub/status/1727291161981993093">initial breach</a> was identified when a staggering $87 million was siphoned off through the Heco chain bridge. A closer inspection of the blockchain revealed the trail of stolen funds across multiple addresses:</p>



<ul>
<li>Exploiter Wallet: The main address associated with the exploit is <a href="https://etherscan.io/address/0xfc146d1caf6ba1d1ce6dcb5b35dcbf895f50b0c4">0xfc146d1caf6ba1d1ce6dcb5b35dcbf895f50b0c4</a>, which received a substantial amount of the illicit funds.</li>



<li>Holding Wallet: Currently, a significant sum of $63 million remains in <a href="https://etherscan.io/address/0xe47e6dA16Bb83EB0FD26b3F29b15CE8Fab089B9e">0xe47e6dA16Bb83EB0FD26b3F29b15CE8Fab089B9e</a>, purportedly the wallet where the stolen funds are being held.</li>
</ul>



<p>The attack was carried out by transferring assets to externally owned accounts (EOAs) and swapping them for Ethereum (ETH).</p>



<p>HTX, also a victim, lost about $12 million from its hot wallets. In an attempt to secure what was left, the HTX team transferred all the funds from some of their hot wallets to a Huobi Recovery address, <a href="https://etherscan.io/address/0x18709e89bd403f470088abdacebe86cc60dda12e">0x18709e89bd403f470088abdacebe86cc60dda12e</a>.</p>



<p>Additional addresses linked to the stolen funds are as follows:</p>



<ul>
<li><a href="https://etherscan.io/address/0x6a40dfe3008bc3f99907e6dff4d041f933493411">0x6a40dfe3008bc3f99907e6dff4d041f933493411</a></li>



<li><a href="https://etherscan.io/address/0x640e567a5041c7108033dadb0b47a3f7aedd661b">0x640e567a5041c7108033dadb0b47a3f7aedd661b</a></li>



<li><a href="https://etherscan.io/address/0x945647f6225a44e35a0ea50f9fe2b4321794aa29">0x945647f6225a44e35a0ea50f9fe2b4321794aa29</a></li>



<li><a href="https://etherscan.io/address/0x153d99836e197f92a8385ba80afbb57b69de2cc1">0x153d99836e197f92a8385ba80afbb57b69de2cc1</a></li>



<li><a href="https://etherscan.io/address/0x7abd8dda6cca1785af2f812b171b98d6924ff5d2">0x7abd8dda6cca1785af2f812b171b98d6924ff5d2</a></li>
</ul>



<p>The common denominator in these breaches appears to be compromised private keys, echoing the vulnerability that led to a previous $125 million hack on another of Justin Sun’s ventures, the Poloniex exchange. Justin Sun has <a href="https://twitter.com/justinsuntron/status/1727304656622326180">assured</a> the community that HTX will fully compensate for the losses and that an investigation is underway to uncover the specific causes of the exploit.</p>



<h2 class="wp-block-heading">Lessons Learned</h2>



<p>The recurrence of such high-profile attacks suggests that the robustness of private key management and operational security needs to be re-evaluated. The repeated nature of these incidents on Justin Sun's platforms suggests a potential systemic issue that needs to be addressed.</p>



<p>Moreover, these incidents serve as a critical reminder about the essential role of <a href="https://hacken.io/discover/wallet-security/">wallet security</a>. Ensuring the safety of wallets through continuous <a href="https://extractor.hacken.io/">real-time monitoring</a>, quick action in response to any suspicious activity, thorough security checks, and strict adherence to the best practices for handling private keys is paramount to protecting assets in the DeFi ecosystem.</p>





<h2 class="wp-block-heading">Conclusion</h2>



<p>The Heco chain bridge and HTX exploits are sobering reminders of the <a href="https://hacken.io/discover/defi-security/">potential risks in the DeFi space</a>. These incidents reinforce the need for the Web3 community to adopt a security-first mindset. As we await the findings of the ongoing investigations, the responsibility lies with every stakeholder in the ecosystem to bolster their defenses, anticipate breach attempts, and fortify the trust in the technology that underpins the future of finance.</p>

Heco Bridge Hack Explained

<p>On November 1, 2023, Onyx Protocol, a fork of Compound Finance, fell prey to an attack, resulting in the loss of 1164 ETH ($2.1 million at the time of the attack). As we analyze the attack, we realize this was not just an isolated incident but a stark reminder of the <a href="https://hacken.io/discover/defi-security/">inherent risks in the DeFi space</a>. Let's take a closer look at what happened and what we can learn from it.</p>



<h2 class="wp-block-heading">Inside The Attack</h2>



<p>The security flaw exploited in Onyx and other Compound forks—known as an "empty pool attack"—occurred due to a vulnerability in the Compound V2 code when initiating new, unfunded markets. Attackers took advantage of Onyx's recently added, unfunded PEPE pool. The Onyx’s breach contributed to cumulative losses of over $10 million across similar platforms.</p>



<p>By minting oPEPE tokens in this empty pool and subsequently inflating their value through strategic donations, the attackers could borrow other assets against the overvalued oPEPE. They leveraged a rounding error in the protocol, which allowed them to redeem more than what was due, effectively draining the protocol’s resources.</p>



<figure class="wp-block-image"><img src="https://wp.hacken.io/wp-content/uploads/2023/11/image-1.jpg" alt="" class="wp-image-20958"/><figcaption class="wp-element-caption"><em>A breakdown of Onyx Protocol attack, PeckShield</em></figcaption></figure>



<p>Exploiter address: <a href="https://etherscan.io/address/0x085bdff2c522e8637d4154039db8746bb8642bff"><strong>0x085bdff2c522e8637d4154039db8746bb8642bff</strong><br></a>Attack tx: <a href="https://etherscan.io/tx/0xf7c21600452939a81b599017ee24ee0dfd92aaaccd0a55d02819a7658a6ef635">0xf7c21600…<br></a>Repeat exploiter address: <a href="https://etherscan.io/address/0x5083956303a145f70ba9f3d80c5e6cb5ac842706">0x5083956303a145f70ba9f3d80c5e6cb5ac842706<br></a>Repeat-attack tx: <a href="https://etherscan.io/tx/0x27a3788d504af542681436bfdecf1823f7a8a691d04309ad33e6d3825e899746">0x27a3788d…</a></p>



<p>The 1164 ETH profits, which amount to $2.1 million, were first transferred to an intermediary address, and then 1140 ETH were moved into Tornado Cash. In addition, the attacker shared a total of 19.5 ETH of the stolen funds with those who asked. Robin Hood vibes, anyone?</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
https://twitter.com/hackenclub/status/1719984294918041644?ref_src=twsrc%5Etfw
</div></figure>



<h3 class="wp-block-heading">Onyx Protocol Losses</h3>



<figure class="wp-block-image size-large"><img src="https://wp.hacken.io/wp-content/uploads/2023/11/Знімок-екрана-2023-11-10-о-17.14.48-1024x491.png" alt="" class="wp-image-20995"/><figcaption class="wp-element-caption">Source: DefiLlama</figcaption></figure>



<p>The total value locked (TVL) has been down <strong>87%</strong> from $2.9M before the hack to $392K after the hack. This is a true cost of the lagging security. We call it double damage. Users rush to withdraw their funds after the exploit. The hack itself accounted for 1164 ETH, and then the protocol lost another 250 ETH due to a damaged reputation and market withdrawals. </p>



<h2 class="wp-block-heading">Lessons Learned</h2>



<p><strong>1. Higher Decentralization:</strong> After the attack, the Onyx team started planning how to pay back the lost money. This could have been avoided if more people were involved in making decisions for the protocol. The protocol’s Proposal 22, which initiated the lending market for PEPE memecoin, had alarmingly low community participation, indicating the need for greater oversight.</p>



<p><strong>2. Inherited Risks in Forking:</strong> Onyx’s troubles were magnified by its status as a fork of Compound Finance, which came with pre-existing vulnerabilities. These same vulnerabilities had been exploited in other forks like <a href="https://rekt.news/hundred-rekt2/">Hundred Finance</a> and <a href="https://rekt.news/midas-rekt2/">Midas Capital</a>. It's imperative for forks to not only inherit code but also to inherit the lessons from past exploits.</p>



<p><em>For enhanced security, Compound V2 forks should mint and then burn a number of cTokens when opening new markets, initially setting the collateral factor to zero to maintain a non-zero total supply, and subsequently adjusting the collateral factor to the desired level.</em></p>



<p><strong>3. Importance of Audits and Security Measures:</strong> Despite being audited by Certik, Onyx fell through the cracks due to market-specific conditions. This underlines the importance of continuous security assessments that consider dynamic market conditions, not just static code analysis.</p>



<p><strong>4. Stay Ahead of Hackers:</strong> The exploit highlights how attackers are often ahead of the curve, exploiting <a href="https://hacken.io/discover/smart-contract-vulnerabilities/">known vulnerabilities</a> before teams can patch them. It's a clear signal to DeFi projects to remain vigilant and proactive about security.</p>



<p><strong>5. The Community’s Role:</strong> For larger protocols like Compound, community engagement often helps catch vulnerabilities. Onyx lacked this level of engagement, which could have provided an additional layer of security.</p>



<h2 class="wp-block-heading">Conclusion</h2>



<p>The Onyx Protocol hack serves as a wake-up call to the DeFi community. It teaches the importance of community vigilance, rigorous security practices, and the inherent risks of forking code. Moving forward, let's use what happened to Onyx as a guide for making the world of DeFi safer for everyone.</p>

Onyx Protocol Hack Explained: A Deeper Dive Into $2.1M Exploit

<h2 class="wp-block-heading">TL;DR</h2>



<ul>
<li>In May 2023, a DeFi platform, Fintoch, rug pulled its users for $31.6M.</li>



<li>Fintoch claimed to be backed by Morgan Stanley, had a fake CEO played by an actor, and offered outrageous 1% daily returns.</li>



<li>The case goes in DeFi history as the biggest exit scam of 2023.</li>
</ul>



<p>On May 22, 2023, Fintoch – a fraudulent DeFi exchange operating on BSC – <a href="https://hacken.io/discover/rug-pull-explained/">rug pulled</a> their investors with a shocking $31.6 million scam. A reputable on-chain analyst, ZachXBT, was the first to draw widespread media attention to this scam.</p>



<h2 class="wp-block-heading">Key Events in Fintoch Crypto Scam</h2>



<ul>
<li>Launched in March 2023, Fintoch posed as a legit DeFi platform with backing from the prominent Morgan Stanley. However, Morgan Stanley <a href="https://www.morganstanley.com/content/dam/msdotcom/global-offices/pdf/Indonesia/Indonesia_Fintoch_Important_Notice.pdf">debunked</a> these claims in a statement in May.&nbsp;</li>



<li>In early May, the Monetary Authority of Singapore (MAS) <a href="https://t.co/6rneqrEikZ">issued</a> a cautionary investor warning regarding Fintoch. Around the same time, Fintoch made claims of launching its own blockchain.</li>



<li>Fast forward to May 22: stolen USDT finds its way to TRON and Ethereum network. On May 23, the platform abruptly halted withdrawals, citing a supposed chain migration.</li>



<li>However, the real bombshell dropped a day later. It was on May 24 that a collective outcry about the withdrawal issues on X raised the alarm among on-chain experts, ultimately leading to the exposure of the scam.</li>



<li>A bonus twist? Bob Lambert, the supposed CEO of Fintoch, turned out to be nothing more than a paid actor! His real name is <a href="https://www.imdb.com/name/nm2697626/">Mike Provenzano</a>, and he has played in several short films and series.&nbsp;</li>
</ul>



<p>A total of <strong>$31.6 Million</strong> was stolen from deceived users.</p>



<figure class="wp-block-image"><img src="https://lh3.googleusercontent.com/B-wmv_o9Q3raridTd91gpZ3Weq5SaHdapHP23dBj-z10HVlU4ungNZCRfQTZQFalRWGj4LondmbZqsGcnNiG3TPgG6nmPJWvKrHpmvuxIYV4oXU-BUDN1DJgsVNMMA43ss04dbHV7xzLmDoyPdSghK4" alt="Bob Lambert - a paid actor was posing as the CEO of Fintoch."/></figure>



<h3 class="wp-block-heading">Looking Through Deception: How Fintoch Deceived Everyone?</h3>



<p>Fintoch lured investors with the promise of a 1% daily ROI and claimed affiliation with Morgan Stanley. Although investors were warned numerous times, people rode the bandwagon and invested millions.</p>



<p>The Fintoch rug pull scam used deceptive techniques, including:</p>



<ul>
<li><strong>False Identity: </strong>Claimed ties to Morgan Stanley, used actor Bobby Lambert as fake CEO.</li>



<li><strong>Unrealistic Returns: </strong>Promised unsustainable 1% daily returns indicate a Ponzi scheme.</li>



<li><strong>Social Media Deception: </strong>Used platforms like X and Telegram, used bots and shills for fake reviews on Trustpilot and Medium.</li>



<li><strong>Blockchain Tricks: </strong>Used smart contracts for fund collection and bridges for moving stolen assets across blockchains (e.g., Tron, Ethereum) to operate covertly.</li>
</ul>



<h2 class="wp-block-heading">What Sparked The Suspicion?</h2>



<p>On May 24, Fintoch transferred <a href="https://www.chainabuse.com/report/1b126c11-b07b-4f40-9e11-149fa006d12f">31.6 million USDT</a> to multiple addresses on the Tron and Ethereum networks:</p>



<ol>
<li>The DFintoch project deployed the <a href="https://bscscan.com/tx/0x3ef479ba75e07ad04f02b5a5f4df476bbbc83bb5d15fdcd2acd1955a4e87fce6">FintochSTO contract</a>. During deployment, 100,000 FTH tokens were minted and sent to the 0xfcE4.. address.</li>



<li>On May 22, 2023, a transfer of 34,341 FTH tokens was made from 0xfcE4.. to 0x19a0..</li>



<li>After that, the scammers <a href="https://bscscan.com/tx/0xa5e64161928ee40f6af02a32fc5c1fb9efa05cca6b91d88326279329b71c7ea2">swapped</a> FTM tokens to BSC-USD and used Multichain and SWFT to bridge the stolen funds.</li>
</ol>



<p>This move caused panic among investors as they reported being unable to withdraw their assets.</p>



<p>Following Fintoch’s silence on the withdrawal issue, several users flocked to the comment section of the platform’s last tweet, published on May 23, demanding an explanation. Their pleas were met with cold automated bot responses.</p>



<p>After a few days of inactivity, on May 26, the stolen USDT started <a href="https://twitter.com/zachxbt/status/1661921410367774722">moving on Tron to different deposit addresses</a> on exchanges like Binance and Huione Pay.</p>



<p>So far, there has been no legal action or reimbursement plan, as the identities of the real founders remain anonymous.&nbsp;</p>



<figure class="wp-block-image"><img src="https://lh6.googleusercontent.com/FSK1pX_fo6ySQEGqLY0x54c5plFVRGJ906vj_Fu7pKKESX9LvOSPk0f-_1vl7pb-fJFK0LbRdm8OEX_CjoL5osqKTYmKeTKvcmhnghd98cgdaGmoMGawHdiHnqHvCQx52ipVaR8EUqE9esjp9JivMtk" alt="An illustrative representation depicting the flow of stolen funds."/><figcaption class="wp-element-caption">Source: <a href="https://x.com/zachxbt/status/1661129110062788608?s=20" target="_blank" rel="noreferrer noopener nofollow">ZachXBT</a></figcaption></figure>



<h3 class="wp-block-heading">Aftermath &amp; Reactions</h3>



<p>The aftermath of the Fintoch rug pull scam had a profound impact on both investors and the reputation of DeFi.&nbsp; First and foremost, investors who had put their money into FTC (the Fintoch native token) found themselves in a tough spot, holding onto assets that had essentially lost their value.&nbsp;</p>



<p>What made matters worse was that the Fintoch team remained anonymous, leaving these investors with no real options for recovery or legal action. But the ramifications extended beyond the immediate victims. The scam shed a bad light on the reputation of crypto, implanting seeds of skepticism, especially toward emerging DeFi projects.</p>



<p>This incident didn't just impact the interest of disheartened investors. It also drew the attention of regulators, legislators, and the media. BSC, where FTC had been actively traded, also took a hit.</p>



<div id="blog-request-quote-container"></div>



<h2 class="wp-block-heading">Post-Hack Security Measures &amp; Lessons Learned</h2>



<p>Fintoch was a Ponzi project that showed all the warning signs of an exit scam. Many of the project’s claims — its CEO, affiliation with Morgan Stanley, and registration in Silicon Valley — were completely fabricated.</p>



<p>It promised guaranteed ROI and multiple organizations issued warnings about the scam. Despite this, the founders were able to net over $31M of user funds. This Fintoch rug pull was one of the largest <a href="https://www.coindesk.com/tech/2023/06/02/crypto-investors-lost-54m-to-rugpulls-scams-in-may-blockchain-security-firm-defi/">exit scams in the DeFi in 2023</a>. And it highlighted the risks and vulnerabilities of investing in unregulated and unverified projects.</p>



<p>In our view, the best approach is to check a project’s rating by <a href="https://coinweb.com/comparisons/best-smart-contract-audit-companies/">different auditing companies.</a> It gives you a heads-up if there is something suspicious.</p>

Fintoch Rug Pull Explained

<p><strong>TL;DR</strong></p>



<ul>
<li>SushiSwap suffered a reentrancy attack on April 9, 2023.</li>



<li>The attackers stole $3.3 Million, but white hats gracefully recovered over 1,000 ETH.</li>



<li>The hacker exploited a vulnerability in a new routing contract launched four days before the attack.</li>
</ul>



<p>On April 9, 2023, unknown hackers managed to steal $3.3M, with one user @0xsifu losing 1,800 ETH. The main flaw? The hacker exploited an “approve-related bug” in the RouterProcessor2 smart contract, which caused a failure to validate access permissions halfway through a swap transaction.</p>



<p><strong>Key points:</strong></p>



<ul>
<li>The exploited contract was introduced four days before the hack.&nbsp;</li>



<li>All users who had approved the RouteProcessor2 contract were at risk.</li>



<li>The risk spanned across 14 chains: Arbitrum Nova, Arbitrum, Avax, Boba, BSC, Ethereum, Fantom, Fuse, Gnosis, Moonbeam, Moonriver, Optimism, Polygon, Polygon ZkEVM.</li>
</ul>



<p>Fortunately, the contract had relatively few approvers, which limited the breach's scale, preventing it from being even more significant. The total losses accounted for <a href="https://rekt.news/sushi-yoink-rekt/">$3.3 million</a>.</p>



<h2 class="wp-block-heading">Vulnerability &amp; Root Cause</h2>



<p>There was a sneaky flaw in the swap transaction involving permissions. But the main cause of the hack was – the <em>RouteProcessor2</em> contract, which was barely four days old when the hackers struck.</p>



<p>Let's dig deeper.&nbsp;</p>



<h3 class="wp-block-heading">What Made It Such An Easy Target?</h3>



<p>Firstly, the contract failed to properly validate the route parameter that users were sending for the <em>processRoute</em> function. This gave attackers the keys, and they steered that route right to their malicious controlled pool.</p>



<p>Then, the hackers summoned the <em>swapUniV3</em>, which did a nifty trick – it changed the <em>lastCalledPool</em> variable to their pool's address and quickly stopped at the swap function of the malicious pool.</p>



<p>Next, that swap function called <em>uniswapV3SwapCallback</em> to check if the sender was the lastCalledPool. And guess what? The callback was accepted since the attacker manipulated that value to point to their pool's address.</p>



<p>Using it, the attacker constructed transactions with one goal – to drain tokens from the accounts of those unsuspecting users who had given the green light to the new <em>RouteProcessor2</em> contract.</p>



<figure class="wp-block-image"><img src="https://lh6.googleusercontent.com/mXxN0BiXr6dBuaQKLqmV8ep7jDJdBpnKwuPrN_Vs1_fC33fQUKyTTe5BdVT-6tCmiwDVrc5t386eItB-VgZl7cjVIHQCpzV-_kS01BT5rzKrlAshmHORyDekD9X5H05vEkhfuyblx-Vqczd91mdT6ZI" alt="Attackers created a malicious pool to exploit the validation bug and drain funds."/></figure>



<h2 class="wp-block-heading">What Tools and Techniques Were Used By Hackers?</h2>



<p>SushiSwap hacker employed the following methods:</p>



<ul>
<li><strong>Etherscan </strong>– to monitor the activity of the RouterProcessor2 contract and identify potential victims.</li>



<li><strong>Approval exploit </strong>– to steal funds from SushiSwap’s RouterProcessor2 contract, bypassing the permission check by manipulating the storage slot.</li>



<li><strong>Flash loans </strong>– to obtain large amounts of ETH and USDC from protocols such as Aave and dYdX. The hacker then used these funds to interact with the RouterProcessor2 contract and trigger the exploit.</li>



<li><strong>Reentrancy attack </strong>– to repeatedly call the <em>swap3callback</em> function and drain funds from multiple victims in one transaction. This technique exploits a <a href="https://hacken.io/discover/reentrancy-attacks/">reentrancy vulnerability</a> in some smart contracts that do not prevent recursive calls.</li>
</ul>



<h2 class="wp-block-heading">The Heroes: White Hats Save The Day</h2>



<p>At first, a 3rd-party security firm identified the hacker’s initial transactions, blocking a loss of 100 ETH. But after this ‘yoink’ attack, the hacker made a second attempt and succeeded. Sushi was already on its toes, so quickly called on <a href="https://coinweb.com/wiki/white-hat-computer-hacker/">white hat hackers</a> for rescue.&nbsp;</p>



<p>On the day of the attack, the white hat community recovered <a href="https://twitter.com/jaredgrey/status/1645059641041121280">over 1,000 ETH</a> of the stolen funds:</p>



<ul>
<li>300 ETH recovered by 0XCoffeBabe</li>



<li>700 ETH by Lido</li>



<li>At least 4 ETH across 600 addresses by Anish Agnihotri</li>
</ul>



<p>Jared Grey, Sushi's Head Chef, acknowledged the error and advised users to revoke their approvals.</p>



<h3 class="wp-block-heading">Sushi Reimbursement Plan</h3>



<p>Just three days post-exploit, Sushi announced a reimbursement plan to calm its user base. They came up with a Merkle Claim contract that affected people could use to retrieve funds from the white hats’ addresses.&nbsp;</p>



<p>Even better: SushiSwap developed a tool to check for exposure across various networks, including Ethereum, Polygon, Avalanche, Arbitrum, Gnosis, Optimism, and others.</p>



<h2 class="wp-block-heading">Market Reactions &amp; Consequences</h2>



<p>The SUSHI token experienced a minor <a href="https://beincrypto.com/sushiswap-exploit-sushi-tanks-6/">6% drop</a> in the 24 hours after the exploit. The damage, fortunately, wasn't massive or widespread.</p>



<p>Users affected were either swiftly drained or had their <a href="https://twitter.com/geek_sg/status/1645048235860586496">permissions revoked</a>, and the heroic white hat efforts played a significant role in minimizing the PR fallout. Nevertheless, this incident remains a significant source of embarrassment for SushiSwap, and it appears that the drama isn't over yet.</p>



<p>Just a week before the hack, Jared Grey, SushiSwap's key figure, highlighted a substantial surge in volume for the DEX's cross-chain swap (xSwap). On top of that, Sushi’s DAO recently found itself in the <a href="https://forum.sushi.com/t/head-chef-jared-greys-official-sec-statement-faq/11918">crosshairs</a> of the U.S. SEC. The legal case is yet to play out.</p>



<div id="blog-request-quote-container"></div>



<h2 class="wp-block-heading">Lessons Learned</h2>



<p>Let's talk about the lessons learned from this SushiSwap hack. It underscores the critical importance of validating user-provided input. In this case, the failure to validate user-provided routes for RouteProcessor2 allowed the attacker to establish a malicious pool and take tokens from users who had granted approvals for RouteProcessor2.</p>



<p>Like many of the most significant <a href="https://coinweb.com/how-to-avoid-defi-crypto-scams/">DeFi hacks</a> we've seen, this attack took advantage of vulnerabilities in unaudited code. Therefore, prioritizing smart contract audits and penetration testing should be the go-to approach for most projects in the DeFi space.</p>



<p>On top of that, the active involvement of white hat hackers proved invaluable post-exploit. Hence, this case also proves the importance of engaging a broader community, including through <a href="https://hacken.io/services/bug-bounty/">bug bounties</a>, for your cybersecurity needs. Sushi provided a more modest bounty than the industry standard, but thankfully, passionate white hats quickly came to help.</p>

SushiSwap DEX Hack Explained

<p><strong>TL;DR</strong><br><strong>Date of Hack:</strong> July 30, 2023.<br><strong>Amount Lost:</strong> $69 million.<br><strong>Key Vulnerability:</strong> What was initially assumed as reentrancy turned out to be an inherent vulnerability in Vyper, a Pythonic programming language for Ethereum smart contracts used by Curve and other decentralized protocols.</p>



<h2 class="wp-block-heading">What Happened</h2>



<p>On July 30, 2023, Curve Finance – a popular DEX – fell victim to a <a href="https://hacken.io/discover/reentrancy-attacks/">reentrancy attack</a>. But the root cause was way deeper than most people, including Curve, initially assumed. There was a bug in the Vyper programming language, causing a malfunction in the reentry guard that <a href="https://www.chainalysis.com/blog/curve-finance-liquidity-pool-hack/">led to a theft of $69 million</a>.</p>



<p>The hack was initiated with $11.5M from the NFT lending protocol, JPEG'd's pETH-ETH pool. However, the attacker didn’t stop there:</p>



<ul>
<li>JPEG’D lost $11.5M from the pETH/ETH pool</li>



<li>Alchemix lost $20.5M from the alETH/ETH pool</li>



<li>Metronome lost $1.6M from the msETH-ETH pool</li>



<li>And Curve itself lost $24.2M from the CRV/ETH pool</li>
</ul>



<p>Meanwhile, another leading decentralized exchange, Ellipsis, reported a loss of $78,000 due to an attack on their BNB stable pools.</p>



<p>Around $69M was stolen; after all refunds, the total loss is about $20M.</p>



<h2 class="wp-block-heading">The Ultimate Root Cause</h2>



<p>Initially, Curve thought it was a "read-only reentrancy" issue that had plagued other protocols before. But the actual root cause was more fundamental. In this security breach, the root problem was a 0-day compiler bug in the older version of Vyper, which remained undetected until the attackers exploited it.</p>



<p>Vyper is a smart contract programming language tailored for the <a href="https://coinweb.com/wiki/ethereum-virtual-machine-evm/">Ethereum Virtual Machine (EVM)</a>. The vulnerability was found on Vyper’s versions 0.2.15, 0.2.16 and 0.3.0.</p>



<p>This bug causes a mismatch in storage slots and disrupts the non-reentrant protection. This vulnerability permits attackers to intervene in transactions between these functions, distort LP token prices, and drain the pool.</p>



<p>It has affected other projects like Conic Finance and EraLend earlier.</p>



<p><strong>Here's what went wrong:</strong> The <a href="https://beincrypto.com/curve-finance-exploit-public-bounty-reward/">initial investigations</a> highlighted that the Vyper compiler did not correctly implement the reentrancy guard to lock the contract. As a result, two functions, "add_liquidity" and "remove_liquidity," had a mismatch in their storage.&nbsp;</p>



<p>As a result, the attackers could repeatedly insert transactions between these two functions, allowing them to manipulate LP token prices and deplete the pool of funds.</p>



<h2 class="wp-block-heading">What Tools &amp; Techniques Were Used To Exploit Curve?</h2>



<p>The hackers used a combination of tactics to exploit Curve.fi. Here's a breakdown:</p>



<ul>
<li><strong>Price manipulation with Vyper Compiler:</strong> Using the Vyper compiler vulnerability, the hackers altered stablecoin prices in pools like 3pool, sUSD, renBTC, and saave on Curve. They then traded these stablecoins for other tokens at inflated rates.</li>



<li><strong>Flash loan:</strong> The hackers used flash loans that allow users to borrow cryptocurrency without providing collateral if they repay it in the same transaction. They borrowed over <a href="https://www.bloomberg.com/news/articles/2023-07-31/crypto-exchange-curve-sees-1-5-billion-flee-or-lost-after-hack-crv-token-drops#xj4y7vzkg">$100M worth of stablecoins from Aave</a>, a DeFi lending platform, to maximize the impact of their attack.</li>



<li><strong>Anonymity:</strong> The hackers took measures to conceal their identity and evade tracking by law enforcement, using multiple wallets, mixing services, and DEXs. Plus, they returned some of the stolen funds to Curve to mitigate legal consequences.</li>
</ul>



<p><img style="" src="https://lh5.googleusercontent.com/IgS--qfcr99pDdTHs0meFRcfLKUoESlXnaqVze4tbsTWvCAfaa4OPj3Z6LUoVRZBYydns1nwXfUXKUTi9dPLtIoD1DXF8wBJ4V320UWci80unaLYwDRRkCQD-1UFC-mfygeQggTI4Zhy5JbH0Ymmehw" alt="Hackers used reentracy bug to exploit the smart contract."></p>



<h2 class="wp-block-heading">The Heroes</h2>



<p>In a rare successful case, the white hat community was able to recover 70% of all losses. The heroes in this event were the <a href="https://chain.link/education-hub/maximal-extractable-value-mev#:~:text=What%20Is%20MEV%3F,during%20the%20block%20production%20process.">Miner Extractable Value (MEV)</a> bots and white hats from the ETH Security Community front-running the hackers' transactions. Only in crypto, right?</p>



<p><a href="https://etherscan.io/address/0xc0ffeebabe5d496b2dde509f9fa189c25cf29671">C0ffeebabe.eth</a>, an MEV bot operator, was one such white hat who returned 2,879 ETH to hacked DEX using a maximal extractable value Ethereum-arbitrage trading bot to front-run the hackers. However, for the rest of the amount, the efforts continued.&nbsp;</p>



<p>In a spirit of collaboration, Curve, Metronome, and Alchemix united on August 3. Their shared goal? To recover the remaining stolen funds.</p>



<p>They offered 10% ($7M) and promised to take no legal action if the full amount was to be returned by August 4. Surprisingly, the <a href="https://cointelegraph.com/news/curve-vyper-exploit-whole-story-so-far">hackers returned 4,820.55</a> Alchemix ETH (alETH) to the Alchemix Finance team and 1 ETH to the Curve.fi team by August 5.</p>



<p>On August 6, Curve Finance declared a reward of 10% to anyone who could identify the hackers. The reason? Firstly, the deadline for the hacker had passed and only 70% of the stolen funds were returned.</p>



<p>At the time of writing, factoring in all the refunds made, the total losses have now settled at <strong>$20M</strong>.</p>



<figure class="wp-block-image is-style-default"><img src="https://lh5.googleusercontent.com/Xi4ujo7347e2oJr9TQypZncqmSsx7LtgYSEug1c8eTxXbEZ5eVHBixtIK1qdmoVbA-TWe0pvk04257cXkFVEkrwW1LVNdLxG45WSjRELt6HtIBG7XF8xvTKDY_N2vr3xZD0hNWf5d4dfw1plxztkXfw" alt="Visual chart"/><figcaption class="wp-element-caption">Source: <a href="https://www.chainalysis.com/blog/curve-finance-liquidity-pool-hack/">Chainalysis</a></figcaption></figure>



<h2 class="wp-block-heading">Consequences &amp; Reaction</h2>



<p>The security incident stressed DeFi protocols, highlighting worries about its impact on the crypto market. This vulnerability could endanger all pools using Wrapped Ether (WETH).</p>



<p>The hack sent shockwaves through the DeFi community, causing many users to withdraw their funds from Curve and other Vyper-based protocols.&nbsp;</p>



<p>The total value locked in Curve plummeted by nearly half to $1.5 billion within a day of the hack.</p>



<p>As soon as news of the hacks spread, the <a href="https://rekt.news/curve-vyper-rekt/">CRV price dropped nearly 30%</a> following the hack, falling to a low of $0.48 amid fears that Egorov's collateralized loans would be liquidated.</p>



<p>This decline and the worry that the hackers might flood the market with their stolen CRV raised concerns about potential problems for other DeFi platforms.</p>



<p>One platform in particular, AAVE, faces the risk of debt because of a large borrowing position secured with CRV tokens, which is well-known to the public and managed by Egorov.</p>



<div id="blog-request-quote-container"></div>



<h2 class="wp-block-heading">Post-Hack Security Measures &amp; Lessons Learned</h2>



<p>Curve and other <a href="https://coinweb.com/wiki/protocol/">protocols</a> should not be blamed for the attack as it is quite hard to pinpoint where the blame lies. These compiler-level issues came as a surprise to all those involved.&nbsp;</p>



<p>Instead of targeting read-only reentrancy issues, the attackers went deeper, looking for a way into a more fundamental layer. Although this Vyper bug has caused hacks in the past,&nbsp; it still went unnoticed.</p>



<p>One effective way to avoid such hacks could be to audit both <a href="https://hacken.io/services/blockchain-security/smart-contract-security-audit/">audit projects' smart contracts</a> and the underlying <a href="https://hacken.io/discover/blockchain-architecture-layers/">blockchain architecture</a>. For instance, a <a href="https://hacken.io/services/blockchain-security/blockchain-protocol-security/">blockchain protocol audit</a> doesn't merely assume the stability of the underlying language; it rigorously tests it. This could have made a significant difference in Curve's scenario.</p>



<p class="has-text-color has-background" style="color:#1b7bdb;background-color:#acffff">"It's not that Curve was easily attacked and no one noticed; the attack must have taken months and was one of the most complex ever seen in DeFi. Unfortunately, the blame goes to the Vyper dev partially and to the Curve developers for choosing Vyper and not Solidity at that specific moment."<br>- <em>Carlo Parisi, Smart Contract Auditor</em></p>



<h3 class="wp-block-heading">What else could be done?</h3>



<p><strong>Compiler version. </strong>Ensure that your code uses the stable compiler version. They are usually better audited and refactored. While no guarantees exist, it's a crucial security practice to follow.</p>



<p><strong>Comprehensive testing</strong>. Ensure thorough test coverage of the code to catch vulnerabilities before deployment. Proper testing decreases the possibility of future bugs.</p>



<p><strong>Private mempools</strong>. Making it easier for white hats to recover stolen assets.</p>



<p><strong>Responsible disclosure</strong>. This is a critical reminder for bug hunters. Refrain from prematurely revealing discovered vulnerabilities to prevent potential misuse by hackers and give users a chance to withdraw funds.</p>

Hacken Hacker

Get our latest updates and expert insights on Web3 security