Certik: Web3.0 Industry Security Report for the First Quarter of 2023
summary
summary
● Malicious actors stole over $320 million (320,332,058) in value from Web 3.0 protocols in Q1 2023.
● This figure is about one-third of the $950 million asset loss in Q4 2022 and about one-quarter of the $1.3 billion asset loss in Q1 2022.
● In the first quarter of 2023, just one security incident caused more than 60% of the losses - the $197 million Euler Finance breach incident.
● 90 exit scams “behind” a total of ~$31 million (31,043,335 ) in assets stolen, while 52 flash loan attacks and oracle manipulation vulnerabilities resulted in over $220 million (222,963,86 ) dollar loss. The Euler incident directly drove up the average loss of flash loan attacks to $4.288 million, while the average loss of assets caused by exit scams was lower at $345,000.
● Outside the field of blockchain, a major event that can be recorded in the history of Web3.0 currency also occurred in the first quarter of 2023: from the collapse of Silvergate Bank, one of the strongest links between the Web3.0 currency industry and the traditional financial industry , to the USDC stablecoin decoupling due to the Silicon Valley Bank crisis.
A PDF download link is attached at the end of the article
IntroductionEuler FinanceOverall, the first quarter of 2023 is relatively quiet. The loss is only 24% of the same period in 2022, and it is a significant drop from the $950 million in the fourth quarter of last year. If it will cause a loss of more than 60% in the first quarter
image description
Source: Dune Analytics
Source: Dune Analytics
Notably, the Arbitrum ecosystem became the first L2 to surpass Ethereum in terms of daily transaction volume at the end of February, and caused another surge in transaction volume after an airdrop to users in March. In the first quarter, Arbitrum’s security incident caused a loss of approximately $4.261 million, accounting for 1.45% of the total value of losses across all Web 3.0 blockchains.
Although the Euler Finance hack was the largest security incident of the quarter, most of the funds were eventually returned, undermining the impact of the incident. Although we cannot precisely describe or guess the reasons for the lower losses due to hacking, fraud and exploits this quarter, one of the big possibilities is also due to lower asset prices, coupled with public awareness of the importance of Web3.0 security. Slowly but continuously growing. We hope that this trend will continue until the second quarter and even the whole year of 2023."Euler's loss: $197 million, then"all recoverable funds
Euler Financewas returned
is "a non-custodial protocol on Ethereum that allows users to lend and borrow virtually any Web 3.0 monetary asset". On March 13, 2023, attackers used flash loans to attack multiple Euler Finance pools. They ended up stealing about $197 million. This incident alone more than doubled the total Web 3.0 security incident losses in the first quarter.
Furthermore, although the mint function in the Euler white paper is described as having a value capped at 19 times the deposit, there is no actual control over the leverage factor when it is called multiple times.
attack process
attack process"repay"The attacker flash loaned 30 million DAI from AAVE, deposited 20 million DAI to Euler through the eDAI contract, and received 20 million eDAI. Before the attacker deposited 20 million DAI, the DAI balance in the Euler pool was 8.9 million. The attacker then calls `eDAI.mint()`. This particular `mint` feature is unique to Eule Financer and allows users to borrow and repay repeatedly. This is a method of creating a borrowing cycle, the result of which is a leveraged borrowing position. When `mint` was called, 200 million dDAI and 195.6 million eDAI were received. (Note: dTokens represent debt tokens, eTokens represent mortgage equity). transfer"mint", repay the 10 million DAI in the eDAI pool to Euler, which destroys the 10 million dDAI. then call again
, creating another borrowing position in the form of 200 million dDAI and 195.6 million eDAI for the attack contract. At this time, the attacker's position is: 390 million dDAI and 400 million eDAI."donate"Call `donateToReserves` (the vulnerable function was introduced in July 2022) to transfer 100 million eDAI to Euler. Due to the absence of proper checks on the collateral status of this act,
The last attacker becomes a "violator" (address with an unhealthy level of debt), whose risk-adjusted liabilities far exceed the value of its collateral, and thus can be liquidated. The liquidator contract deployed by the attacker began to liquidate the "violators", and the liquidator took advantage of the way the platform works to obtain a 20% profit.
After the attack, a wallet associated with the Ronin Bridge attack communicated with the Euler attackers via on-chain messages, attaching an encrypted message and a link to a "decryption tool." This is most likely malware intended to steal funds from the Euler attackers.
It's an intriguing development in the case, and one that reveals the many different tactics and tactics professional hackers employ in the Web 3.0 space.
On March 20, the hackers sent a message on the blockchain announcing their willingness to negotiate.
"We want to make it a little easier for everyone affected to resolve these issues. We have no intention of keeping things that don't belong to us. Establish secure communications and let's come to an agreement."
- Transaction ID: 0xcc73...6a1c0
Although this incident has a "happy" ending compared to many other hacking incidents in the Web3.0 field, it does not mean that the project can hope for the "good intentions" of hackers. Proactive security precautions are critical, as the vast majority of stolen value is never returned.
image description
Source: Twitter
Kokomo Finance and 89 other exit scams
The ongoing threat of exit scams was especially evident in the first quarter. In the first three months of 2023, 89 exit scams stole more than $31 million from investors.Exit scam, what we commonly call project runaway. Also known as "Rug Pull", usually fraudsters will suddenly withdraw a large amount of funds in the project and close the project after "feeding fat" the project, eventually causing the tokens held by investors to lose value. While there are plenty of statistics showing the prevalence and impact of exit scams over the years, there are fewer data and reports examining their characteristics and perpetrators. CertiK examines the entire cycle from the start to the end of an exit scam40 Rug Pulls
In order to better understand the commonalities and differences that lead to their eventual removal from liquidity. By identifying project characteristics and conducting qualitative and quantitative analysis, we were able to identify and analyze common characteristics of Rug Pulls.
Kokomo Finance is a Layer 2 scaling solution for Ethereum deployed on Optimism. On March 26, 2023, Kokomo Finance ran an exit scam. The deployer contract controlled by the project team implemented a malicious contract that allowed them to suspend the lending function of the protocol and transfer deposits to an external address, resulting in a loss of 141 wBTC. As in a classic exit scam, the team deleted all their social media accounts afterwards and the project website is no longer accessible.
It wasn't the biggest hole in the first quarter, nor was it unique. But instead it represents the continuation of this type of scam: money has been stolen from Web 3.0 users to add up.
Scammers phishing in Web3.0 ponds many times
BombFlower
The world of Web3.0 and encryption is constantly evolving. And with this development, communities are beginning to face new and more complex threats and challenges. One such threat is the proliferation of fake wallets designed to trick users into giving away their valuable assets. These fake wallets are an ongoing problem for the Web3.0 community and it will take dedicated effort and research to identify and expose them.
CertiK uncovered an organized scam syndicate. The group organized fake wallets deployed to deceive users and steal user assets. Since the particular evasive anti-forensics feature used by this group is rare, we named it BombFlower. Due to the detection evasion techniques used by the group, these fake wallet mobile apps are likely to be missed by mainstream malware detection tools.
The BombFlower group usually designs these fake wallets to closely resemble legitimate wallets, for example using a similar design and layout to the original website with only minor changes in the domain name. so that it is difficult for users to distinguish.
Fake wallets include backdoors, the generation function of Hook technology, and inject malicious code directly into the Javascript code (such as index.android.bundle) or smali code of the wallet.
Monkey Drainer
Users should double-check the domain names of websites from which wallet applications are downloaded, and as a basic precaution, have anti-malware software running on any computer used for Web 3.0 currency transactions.
Ice PhishingWe've seen some crooks take advantage of a phishing kit commonly known as the Monkey Drainer. These phishing kits provide a quick and easy tool for malicious actors to steal assets from the Web3.0 community. These kits are sold by malicious vendors to would-be scammers looking to steal users' funds, and even if you're not familiar with "scam pros," you can still catch some prey with phishing kits. The Monkey Drainer kit and a similar phishing kit use a technique called "Ice Phishing" to trick users into spending tokens with unlimited permissions.
It is a type of attack unique to the Web3.0 world. Users are tricked into signing permissions, allowing fraudsters to directly consume assets in user accounts. This differs from traditional phishing attacks, which are a form of social engineering and are often used to steal user data, including login credentials and wallet or asset information such as private keys or passwords. This makes Ice Phishing a greater threat to Web3.0 users, because interaction with DeFi protocols requires users to grant permissions, and fraudsters only need to convince users that the malicious addresses they approve are legitimate. Once a user approves a fraudster to spend their assets, there is a risk that the account will be stolen.
Users can protect themselves from Ice Phishing by using sites like revoke.cash or Etherscan's Token Approval Checker to check the permissions they have granted. If there is an unrecognized address or an address that initiates transactions without approval, all permissions granted to it should be revoked.
Traditional financial system takes a hit
image description
Source: CoinMarketCap
Source: CoinMarketCap
The main goal of the Web 3.0 money ecosystem has always been to build a decentralized, free and fair alternative to traditional finance. By developing more Web 3.0 money-native solutions, the industry can be more insulated from the increasingly fragile traditional financial system. Of these, the latter often require government intervention and cessation of transactions to maintain stability.
Recent events in the US and European financial systems have undoubtedly exposed the weaknesses of traditional banks, while the Web 3.0 currency ecosystem has proven its greater resilience and efficiency. By reducing reliance on traditional finance, the Web 3.0 currency ecosystem will have the opportunity to thrive, becoming a robust and decentralized alternative to the increasingly fragile traditional banking system.
Skynet for Community: OverviewSkynet for CommunityIn the first quarter of 2023, CertiK is proud to announce the launch of
, an all-in-one security, due diligence and data platform designed to increase trust and transparency in the Web3.0 ecosystem. The platform strives to provide community users, investors and project teams with the tools and resources they need to easily investigate and understand the Web3.0 ecosystem.
With thousands of Web 3.0 projects creating millions of data points every day, it's easy for users to get lost in the noise. Skynet for Community's rich data-driven insights help users discover new projects, conduct due diligence on projects of interest, and stay abreast of the latest news and developments in the Web 3.0 space. The platform aggregates vast amounts of data into the Web 3.0's most accessible security-focused due diligence tool. Whether it's conducting comprehensive due diligence on actionable on-chain and social data, discovering the latest projects to complete smart contract audits, or unearthing the most valuable industry insights and security best practices, Skynet for Community simplifies the process and All these data are integrated on one platform for users to browse. With a newly designed interface and powerful features, Skynet for Community is the ultimate tool for making informed decisions and promoting trust and transparency in Web3.0 ecosystems.
Skynet for Community: Solutions
Skynet for Community's home page defaults to "Explore New Projects". From this page, you can easily search for items you are interested in and search for brand new items anytime, anywhere.
The Web3.0 Security List lists and ranks projects based on their security scores and market performance. Security Score is a score generated through a proprietary algorithm that calculates and considers a project's code security, fundamental health, operational resiliency, community trust, market stability, and governance strength. Security Score Leaderboards allow users to quickly identify top-performing projects based on their security posture and compare them to similar projects.The Web3.0 KYC team list is publicized and ranked according to the status of the CertiK KYC badge obtained by the project. Project teams who have passed strict background checks will receiveCertiK KYC Badge
, CertiK will award a KYC Gold Badge, KYC Silver Badge, or KYC Bronze Badge based on the verifiable information and level of information provided by the project team. The KYC badge will show that we know the team behind the project and have done the investigation and verification in compliance with CertiK KYC standards, and it also represents the project team's commitment to fulfilling compliance measures.The Web3.0 KOL list is ranked according to the influence score of each KOL, which reflects the influence and scope of their content as KOL output. thisleaderboard
Helpful for those interested in identifying the KOLs who are shaping the Web 3.0 industry. In addition, it also provides an overview of communities and projects related to KOL, allowing users to better understand the hot spots and trends in this field.
Exchange Audit Analytics allows users to perform due diligence on centralized exchanges by showing their on-chain asset holdings. This is the first and most critical step in the verification of reserve certificates.
The Skynet project early warning system can provide the first early warning of Rug Pull attacks and vulnerability events in the Web3.0 currency field. The system will monitor various information sources in real time to identify and report potential Rug Pull attacks and exploits. Users can also access the wallet analyzer through the "Web3.0 Hot Smart Fund List" on the "Explore New Projects" page, or click on any wallet address in the monitoring and governance and autonomy module on the token chain on the project details page to view it.
The smart fund wizard is the access point of the smart currency wallet analyzer function, which allows users to directly search for wallet addresses and view wallet search trends, smart fund lists, and liquidity transaction pairs. Wallet Analyzer provides analysis of wallet addresses and makes it easier for users to interpret on-chain transactions between wallets by showing key wallet characteristics, relationships between wallets, and a visual picture of token transaction activity.
Log in to the Skynet for Community platform now, read the Skynet education hub and watch masterclass teaching and do a high level of due diligence!
CertiK End-to-End Security Solutions
In its commitment to securing Web 3.0, CertiK has developed a number of tools to help projects adopt end-to-end security solutions.CertiK Security Leaderboard
Empowering Web 3.0 users to leverage the expertise of CertiK's audit and security teams to gain a deeper understanding of the security risks of investment projects and make more informed decisions, these users take the entire ecosystem to new heights.
SkyTraceIt can combine on-chain transaction monitoring and off-chain data (such as social public opinion) to conduct real-time and comprehensive security monitoring and analysis on hundreds of Web 3.0 platforms. The advanced version of Skynet Skynet Dynamic Scanning System, Skynet Premium, will be officially launched by CertiK in 2021. Its threat detection model will evolve synchronously with the ever-changing smart contract risk environment through machine learning. This also means that as the threat intelligence library and smart contract vulnerability library continue to accumulate, the platform will become more advanced to adapt to the ever-changing smart contract risk environment. At present, the Skynet dynamic scanning system has been fully upgraded, adding new features such as more dimensions of Skynet trust scores and project-specific project highlights and early warnings.
is a smart, intuitive tracking tool that helps analyze and visualize transaction data from Ethereum and BSC wallets. The tool provides in-depth analysis for identifying and tracking suspicious traffic to and from one's own personal wallet or project team's wallet.CertiK KYC project background check service
Provides identity verification for project teams, including ID authenticity checks using AI-based detection systems to ensure individuals are authentic and match IDs. In addition to real-time validity checks during the authentication process, CertiK will also conduct live video communication with each project team member to verify their identity and other necessary parameters. Due to the increasing anonymity of the team, risky behavior of the project is becoming more and more possible. In addition, the CertiK security leaderboard bestows bronze, silver, and gold KYC badges on project teams that have passed the KYC investigation, which de-anonymizes the project team to the greatest extent, establishes a more complete accountability system, and enhances the reliability of the project. Reliability.
CertiK penetration testing is an essential part of a comprehensive solution for securing Web3.0 applications in operational environments. Our penetration testing services are performed by a team of experienced ethical hackers using proprietary tools to find even the tiniest vulnerability in your code.
SkyHarbor provides an all-in-one solution to protect and monitor digital assets. With its advanced monitoring and threat detection system, SkyHarbor can quickly identify any vulnerabilities or suspicious activity in the system, ensuring your assets are always safe.
ecosystem
ecosystem
CertiK's auditing and end-to-end solutions have covered most of the ecosystems currently on the market, and support almost all mainstream programming languages, providing services for various ecological chains in areas such as blockchain platforms, Web 3.0 asset trading platforms, and smart contract security. Provide security technical support. Ecosystems we are currently working with include:
Get the most out of Web 3.0 by partnering with CertiK Consulting while our team of experienced analysts provide a full service that includes technology assessments, proprietary research and strategic advice.
CertiK is committed to safeguarding the Web 3.0 world, and will focus on security data to continuously analyze the security future and development of Web 3.0. Help users to stay away from "earth dogs" and people stepping into the air, and use technology to give technology value and the way to carry the boat.
The PDF version of the report has been included and a link has been generated, welcome to download and view.
How to download⬇️
