Beosin: 2023 Q1 Global Web3 Blockchain Security Situation Report
Original source:Beosin
Original source:
Data charts are available here: Footprint Analytics: Crypto Analysis Dashboards
Overview of Web3 Security Situation in the First Quarter of 2023Q1 2023,
According to the Beosin EagleEye security risk monitoring, early warning and blocking platform of the blockchain security audit company Beosin, a total of 61 major attacks in the Web3 field have been monitored, with a total loss of about 295 million US dollars, a decrease of about 77% compared with the fourth quarter of 2022. % . The total loss amount in the first quarter of 2023 is lower than in any quarter in 2022.
In addition to the attack incidents, 41 major Rug Pull incidents were detected in the first quarter of 2023, involving an amount of approximately US$20.34 million.From the perspective of the month,
In March, a month with frequent attacks, the total loss amount reached 235 million US dollars, accounting for 79.7% of the total loss amount in the first quarter.From the perspective of the type of project being attacked,
DeFi is the type of project with the highest frequency of attacks and the largest amount of losses this quarter. The total loss amount of 42 security incidents reached 248 million US dollars, accounting for 84% of the total loss amount.From the perspective of chain platform types,
80.8% of the loss amount came from Ethereum, ranking first among all chain platforms.From the point of view of attack methods,
The attack method with the highest amount of loss in this quarter was the flash loan attack, with a loss of about 198 million US dollars in 8 flash loan events; the attack method with the highest frequency was contract vulnerability exploitation, with 27 attacks accounting for 44% of all incidents.From the perspective of capital flow,
Approximately $200 million in stolen assets was recovered during the quarter. Funding recoveries this quarter were better than any quarter in 2022.From the audit point of view,
Only 41% of the projects attacked were audited.
Overview of attack events
In the first quarter of 2023, the Beosin EagleEye security risk monitoring, early warning and blocking platform detected a total of 61 major attacks in the Web3 field, with a total loss of approximately US$295 million. Among them, there was one security incident with a loss of more than US$100 million (Euler Finance flash loan attack lost US$197 million). There were 2 incidents in the range of US$10 million to US$100 million in losses, and 17 incidents in the range of US$1 million to US$10 million.
Attacked item type
secondary title
84% of the loss amount came from DeFi types
Crypto markets have bottomed out following a months-long downturn and multiple black swan events to clear leverage. The TVL of DeFi rebounded in the first quarter as the currency price fluctuated.In the first quarter of 2023, a total of 42 security incidents occurred in DeFi projects, accounting for 68.9% of the total number of incidents. The total loss amount of DeFi reached 248 million US dollars, accounting for 84% of the total loss amount.
DeFi is the type of project with the highest frequency of attacks and the largest amount of losses this quarter.The amount of NFT-type losses ranked second ($18.52 million), mainly from NFT phishing incidents. The third type is individual users, and this category is all phishing attacks. The fourth place in the loss amount is the wallet attack event. From the type point of view,
The 2nd to 4th digits of the loss amount are closely related to user safety.
The amount of losses on each chain platform
secondary title
80.8% of the lost amount came from Ethereum
In the first quarter of 2023, there were 17 major attacks on the Ethereum chain, with a loss of approximately $238 million. The amount of losses on the Ethereum chain ranks first among all chain platforms, accounting for about 80.8%.
The most attacks were detected on BNB Chain, reaching 31. Its total loss was $19.48 million, ranking second among all chain platforms.
The public chain with the third largest loss is Algorand, and the loss comes from the theft of MyAlgo wallet. The Algorand chain has had no major security incidents in 2022.
It is worth mentioning that the amount of losses on the Solana chain in 2022 ranks third among all public chains, and no major attacks were detected in this quarter.
Attack Method Analysis
The attack method with the highest amount of losses in this quarter was flash loans. The 8 flash loan events lost about 198 million US dollars, accounting for 67% of all losses.The most frequent attacks
For contract exploits, 27 attacks accounted for 44% of all incidents. Contract vulnerabilities caused a total loss of US$39.05 million, ranking second among all attack types.
According to the types of vulnerabilities, the top three that caused the most losses were improper business logic/function design, permission issues, and reentrancy. The 17 business logic/function design vulnerabilities resulted in a total of $22.44 million in damages.
first level title
Analysis of Attack Methods in Typical Cases
1 Euler Finance security incident
Event Summary
On March 13, Euler Finance, a lending project on the Ethereum chain, was attacked by a flash loan, and the loss reached 197 million US dollars.
On March 16, the Euler Foundation offered a $1 million reward for information leading to the arrest of the hackers and the return of the stolen funds.
On March 17, Euler Labs CEO Michael Bentley tweeted that Euler "has always been a security-conscious project." From May 2021 to September 2022, Euler Finance accepted 10 audits by 6 blockchain security companies including Halborn, Solidified, ZK Labs, Certora, Sherlock and Omnisica.
On April 4, Euler Labs tweeted that after a successful negotiation, the attackers had returned all stolen funds.
Vulnerability analysis
Vulnerability analysis
In this attack, the donateToReserves function of the Etoken contract did not correctly check the amount of tokens actually held by the user and the health status of the user's ledger after donation. The attacker took advantage of this vulnerability and donated 100 million eDAI, but in fact the attacker only pledged 30 million DAI.
At this point, the health of the user ledger has been restored and the user can withdraw funds. The amount that can be withdrawn is the difference between eDAI and dDAI. But there are actually only 38.9 million DAI in the pool, so users can only withdraw this amount.
secondary title
2 BonqDAO security incident
On February 1, the encryption protocol BonqDAO was attacked by price manipulation. The attacker minted 100 million BEUR tokens, and then exchanged BEUR for other tokens on Uniswap. The price of ALBT dropped to almost zero, which further triggered ALBT The liquidation of the treasury. According to the token price at the time of the hack, the loss was as high as $88 million, but due to the exhaustion of liquidity, the actual loss in the incident was around $1.85 million.
Vulnerability analysis
Vulnerability analysis
In this attack, the attacker carried out a total of two attacks, one is to control the price to lend a large number of tokens, and the other is to control the price to liquidate other people's property to make a profit.
The oracle used by the BonqDAO platform uses the function 'getCurrentValue' instead of 'getDataBefore'.
The hacker became a price reporter by staking 10 TRB tokens (worth only about $175), and modified the price of WALBT tokens in the oracle by calling the submitValue function. After the price is set, the attacker calls the createTrove function of the Bonq contract to create a trove contract, and mortgages 0.1 WALBT tokens to the contract for borrowing operations. Normally, the loan amount should be less than 0.1 WALBT, so as to ensure that the mortgage rate remains in a safe range. However, in the loan process of this contract, the method of calculating the value of collateral is realized through the TellorFlex contract. In the previous step, the attacker has already raised the price of WALBT to an abnormally high level, causing the attacker to lend 100 million BEUR tokens in this loan.
The attacker set the WALBT price abnormally low in the second transaction, thereby using a small amount of cost to liquidate the WALBT tokens mortgaged by other users.
3 Platypus Finance security incident
Event Summary
On February 17, Platypus Finance on the Avalanche platform was attacked due to a problem with the function checking mechanism, resulting in a loss of about $8.5 million. However, the attacker did not implement the withdrawal function in the contract, resulting in the attack proceeds being stored in the attack contract and unable to be withdrawn.
On February 26, the French National Police had arrested and summoned two suspects in the attack on Platypus.
Vulnerability analysis
Vulnerability analysis
The reason for the attack is that there is a problem with the emergencyWithdraw function checking mechanism in the MasterPlatypusV 4 contract. It only detects whether the user’s loan amount exceeds the user’s borrowLimitUSP (loan limit), but does not check whether the user has repaid the debt.
The attacker first lent 44 million USDC to the Pool contract through the AAVE contract flash loan, and then mint 44 million LP-USDC. Then the attacker called the borrow function to lend 41.79 million USPs, and then called the EmergencyWithdraw function immediately.
In the EmergencyWithdraw function, there is an isSolvent function to verify that the loan balance exceeds the maximum loanable value, and if it returns true, it can enter the transfer operation, without considering the verification of whether the debt amount has been repaid. Therefore, the attacker can directly call and successfully withdraw the previously pledged 44 million LP-USDC without repaying the debt.
Fund Flow AnalysisApproximately $200,146,821 in stolen assets were recovered in Q1 2023, accounting for 67.8% of all stolen assets. Among them, the stolen assets of $197 million from Euler Finance have all been returned by hackers. More examples of recoveries include: On February 13, the hackers who attacked dForce returned all the stolen funds of $3.65 million; on March 7, the white hat hackers who attacked Tender.fi returned the stolen funds and obtained 62 Bounties in ETH.
Funding recoveries this quarter were better than any quarter in 2022.Beosin KYT Anti-Money Laundering Analysis Platform
About $23.13 million (7.8%) of assets were found transferred to Tornado Cash, and another $2.54 million was transferred to other mixers. Compared to last year, the proportion of stolen funds transferred to mixers has decreased significantly this quarter. In fact, since Tornado Cash was sanctioned in August last year, the proportion of stolen funds transferred to Tornado Cash has shown a continuous downward trend since Q3 2022.
At the same time, the Beosin KYT anti-money laundering analysis platform found that about $60.02 million (20.3%) of assets were still in the balance of the hacker's address. Some $9.32 million (3.1%) of stolen assets were also transferred to exchanges. Most of the incidents transferred to the exchange were attacks involving a small amount of money, and a small part were phishing incidents that were not noticed by the public until a few days later. Due to reasons such as low attention or delayed attention, hackers have the opportunity to transfer stolen money to the exchange.
Project Audit Situation Analysis
Among the projects attacked in the first quarter of 2023, except for 8 events that cannot be measured by audit (such as phishing attacks suffered by some individual users, etc.), among the remaining attacked projects, 28 have been audited , 25 have not been audited.
In this quarter, there were 27 attacks caused by the exploitation of contract vulnerabilities, of which 15 projects were audited (losses of approximately $31.19 million), and 12 projects were not audited (losses of approximately $7.86 million). The audit quality of the whole market is still not optimistic. It is suggested that the project party must make more comparisons before choosing an audit company. Only by choosing a professional audit company can the project security be effectively guaranteed.
Rug Pull Analysis
In the first quarter of 2023, a total of 41 major Rug Pull incidents were monitored in the Web3 field, involving an amount of approximately US$20.34 million.
In terms of value, 6 (14.6%) Rug Pull incidents were above USD 1 million, 12 incidents (29.2%) between USD 100,000 and USD 1 million, 23 incidents (56%) below USD 100,000 % ).
Among the 41 Rug Pull events, 34 projects were deployed on BNB Chain, accounting for 83%. Why do many fraudulent projects choose BNB Chain? The reasons may be as follows:
1) BNB Chain has lower GAS fees and shorter block generation intervals.
2) BNB Chain has more active users. Fraudulent projects will give priority to public chains with more active users.
3) It is more convenient and faster for BNB Chain users to use Binance to deposit and withdraw funds.
2023 Q1 Security Situation Summary
On the whole, the total loss amount of attack incidents in the first quarter of 2023 is lower than that of any quarter of 2022, and the recovery of funds is also better than that of all quarters of 2022. After a year of hackers rampant in 2022, the overall security of the Web3 field has been greatly improved this quarter.
DeFi is the type of project with the highest frequency of attacks and the largest amount of losses this quarter. A total of 42 security incidents occurred in the DeFi field, 22 of which were derived from the exploitation of contract vulnerabilities (22 audited projects and 11 unaudited projects). If you look for a professional security company to conduct an audit, most of the vulnerabilities can be discovered and repaired during the audit stage.
Rug Pull incidents are still frequent this quarter, and 56% of the projects run away with an amount of less than $100,000. Such projects usually lack official website, Twitter, Telegram, Github and other information, there is no Roadmap or white paper, and the information of team members is suspicious. The period from the project launch to the final run does not exceed three months. It is recommended that users conduct background checks on the project to avoid loss of funds.
secondary title
About Beosin
