DeFi - Adrian Hetman

Adrian Hetman

Subscribe

DeFi

A collection of 25 posts

Monthly DeFi Blood Bath Report #5

Monthly DeFi Blood Bath Report #5

Welcome to another instance of the Blood Bath report. This months we saw a fix of critical bug in OpenZeppelin [https://forum.openzeppelin.com/t/uupsupgradeable-vulnerability-post-mortem/15680] , a Supply Chain attack on SushiSwap and just yesterday we saw a Compound proposal that went wrong [https://www.rekt.news/overcompensated/]. Enough

Monthly DeFi Blood Bath Report #4

Monthly DeFi Blood Bath Report #4

Welcome to another instance of the Blood Bath report. This month was the craziest one in the whole DeFi history due to two events: the Poly Network hack and Samczun’s Whitehack of Sushiswap. This month we saw some big hacks, even excluding PolyNetwork. But what is also important, we

How to stay up to date with BlocSec news?

How to stay up to date with BlocSec news?

Being an auditor is not an easy job. There’s a lot of pressure on us to do our job perfectly. If we don’t, and we miss something, millions are on the line. It’s a bit different than standard web security, where there can be breaches and databases

Monthly DeFi Blood bath report #3

Monthly DeFi Blood bath report #3

Welcome to another instance of Blood bath report. This month we saw many bridges burning and some questionable design decisions that led to hacks. Let’s dive into the topic. Below you will find a summary of all hacks that had happened. All info was compiled from openblocksec [https://github.

Unboxing tx.origin. Rune Token case

tutorial Featured

Unboxing tx.origin. Rune Token case

Today we saw how ThorChain protocol get rekt on multiple levels. First we saw a black-hat attack the protocol and steal $8M. > THORChain has suffered a sophisticated attack on the ETH Router, around $8m. The hacker deliberately limited their impact, seemingly a whitehat. ETH will be halted until it can

DeFi double-edge sword problem

DeFi double-edge sword problem

What DeFi does that traditional financial institution doesn't is democratizing the access to financial instruments for everybody with internet connection and become community-owned. Currently, the most prominent DeFi products are being built on Ethereum. They are utilizing its robust smart contracts system. Smart contracts are composable, which means they can

Replay Mirror Attacks

Replay Mirror Attacks

DeFi is an ever-growing market, and apart from everybody wanting to have a piece of multi-billion dollar industry, there are chains and copycats of protocols found originally on Ethereum. Some of those copycats grew into their respective applications, but also it meant, we have multiple chains we can deploy the

Unboxing Flash Loans

Unboxing Flash Loans

Everybody understands what regular loans are. You need to provide proof of income, reserves, or other information a bank may need to take one. There are, of course, uncollateralized loans where you don't need to put forward any collateral i.e., you don't need to provide any asset in case

Can't wait For DeFi to hit mainstream

Can't wait For DeFi to hit mainstream

Recently I've been going through the process of acquiring my first ever apartment 🏠. I couldn't be happier as this means my hard work is finally paying off, and I can have my own place with my wife and have the next part of my life there. But working in Blockchain

How Eleven.Finance got hacked?

How Eleven.Finance got hacked?

Eleven.finance, a yield aggregator on BSC and Polygon, was exploited for a total of $4.5M. Binance Smart Chain protocols don’t have an easy year will all of the recent hacks in last months happened on that chain. I won’t rant about BSC. I did that already

PancakeHunny Hacked

PancakeHunny Hacked

Ehh…Same exploit used for the 4th time. Devs do not learn, do they?Exploit is very similar to the one found on PancakeBunny [https://www.adrianhetman.com/pancakebunny-exploit-used-for-the-3rd-time/]. 40 ETH was sent through Torando Cash on Ethereum. Below analysis is taken from WatchPugs. [https://watchpug.medium.com/pancakehunny-performance-fee-minting-attack-analysis-e347d12bfdde] https:

Monthly DeFi Blood Bath report

Monthly DeFi Blood Bath report

May had a staggering amount of hacks for DeFi protocols on Binance Smart Chain. I decided to summarize who was hacked, when and for how much. Let’s start as it’s a long list. Spartan Protocol When? May 1st How much? $30M Where? Binance Why? The incident was due

What happens when you don’t test enough?

What happens when you don’t test enough?

Looking at the number of exploits I already covered, you can guess what I’m alluding too. You’re right. You get REKT! But sometimes you also get lucky…somewhat. Credit goes to @Mudit__Gupta [https://twitter.com/Mudit__Gupta] for reporting this on Twitter. Wild Credit was exploited for

AutoShark hacked for ~$745k

AutoShark hacked for ~$745k

Bunnies are reproducing quite fast, and as it turns out, not only in nature but also in the blockchain. Autoshark was nearly 1:1 fork of PancakeBunny, and apart from copying all the logic, they also copied the flawed logic responsible for the PancakeBunny hack. A hacker used 100K BNB

Bogged Finance Hacked for $3.5M

Bogged Finance Hacked for $3.5M

May-22-2021 02:47:06 PM +UTC, BoggedFinance was hacked for ~$3.5M. This was due to the bug in the deflationary logic of the token. Bog Token is designed to be deflationary. 5% is charged with each transaction, 1% burned, and 4% going to the staking profit. Issues were in

PancakeBunny hacked for $40M+

PancakeBunny hacked for $40M+

It’s a nice feeling to finally go to sleep after a hard day and wake up to $40M+ gone from another Binance Smart Chain DeFi protocol…BSC DeFi doesn’t have an easy time right now. This hack’s a “nice” addition to the growing amount of already stolen

$232M lost due to hacks in DeFi alone

$232M lost due to hacks in DeFi alone

I didn’t want to write another post like this, but at 10:36:20 AM +UTC, May 16, 2021, Bearn.fi was exploited, and $11M of funds was stolen from the pool. As Peckshield reports: > The incident was due to a bug in its internal withdraw logic in inconsistently

Stablecoins. The future we were promised

Stablecoins. The future we were promised

A Stablecoins is a cryptocurrency linked to a physical or digital asset or other fiat currencies, like US dollar, gold, or another cryptocurrency. Stablecoins come with all the benefits of standard cryptocurrencies. They allow us to send money directly and instantaneously to other people on the planet, whether it is

Is anybody safe from hackers in DeFi?

Is anybody safe from hackers in DeFi?

Another day, another hack. For some time, it was relatively calm. I mean somewhat as DeFi space had more than two days time span between hacks. On the 12th of May, XToken has been hacked for around $24M. Yup. Adding only hacks that have happened in May, ~$85M were stolen.

State of security of new DeFi projects

State of security of new DeFi projects

This will be a continuation of a rant on how clients should prepare for an audit. [https://www.adrianhetman.com/how-to-prepare-for-a-security-audit/] Opinions and views are my own if you haven’t catch that 😉 I’ve been auditing smart contracts for 8 months now. I’ve seen my fair share of

Intro to DeFi

This won’t be a long post as I don’t want to reinvent the wheel and re-tell the same story as many people have told it much better than I even could. I will do a really brief introduction to DeFi for those who don’t know what it

Four Hacks, one week

ethereum Featured

Four Hacks, one week

This was an interesting week. We saw four hacks; first, two happened to one company in few days, and the third hack fuelled a cross-chain attack that happened to my knowledge. Total value lost from Value DeFi and Rari Capital this week is around $36M, whereas $25M belongs to hacks

blockchain Featured

War on Gas

The main issue haunting the Ethereum network is gas prices for each transaction. High gas prices caused many problems and bizarre situations like Kings of Leon’s NFT were cheaper than a transaction cost when the release of their NFT. It's a massive problem for Ethereum making the applications more

Why hackers can steal from DeFi?

blockchain Featured

Why hackers can steal from DeFi?

DeFi, at the time of writing of this article, has over $65 billion dollars in Total Locker Value (TLV) according to DeFi Pulse [https://defipulse.com]. More than $230M were lost to hackers and scams in 2020 alone. This year's number is only increasing, and we already saw multi-million hacks

You won't hear about this on the TV

You won't hear about this on the TV

Imagine a scenario where a hacker successfully steals money or stocks from some financial institution or maybe from hacking credit cards. A hacker stole $1.5 million in the total value of money. A scenario like this would potentially end up discussed on TV or some major media outlets. Imagine