Lessons from Inverse Finance's hack.
@InverseFinance was hacked for $15 Million, which should not make anyone in #DeFi happy.
Here's a thread 🧵reflecting on what we (and others) can do to avoid going through the same.
More info at:
rekt.news/inverse-financ…
Starts here👇
@InverseFinance was hacked for $15 Million, which should not make anyone in #DeFi happy.
Here's a thread 🧵reflecting on what we (and others) can do to avoid going through the same.
More info at:
rekt.news/inverse-financ…
Starts here👇
2/10
In short, the #exploit employed a vulnerability whereby the market price for a collateral token ( $INV) was manipulated to be higher than it should.
Why higher?🧐
So that the attacker could take out a collateralized loan for more than they should have.
In short, the #exploit employed a vulnerability whereby the market price for a collateral token ( $INV) was manipulated to be higher than it should.
Why higher?🧐
So that the attacker could take out a collateralized loan for more than they should have.
3/10
By withdrawing more assets than they should have been able to, the exploiter has an open window to repeatedly follow this process, profiting at each round.
The hacker achieved this by manipulating a TWAP feed, an oracle source flagged as problematic multiple times.
By withdrawing more assets than they should have been able to, the exploiter has an open window to repeatedly follow this process, profiting at each round.
The hacker achieved this by manipulating a TWAP feed, an oracle source flagged as problematic multiple times.
4/10
The main problem with TWAP (Time-Weighted Average Price) feeds (and why #Fringe does not use them) is that they originate from DEXs.
A DEX like @Uniswap 🦄 enables the permissionless listing of any given asset. This causes some assets, like $INV, to have low volumes...
The main problem with TWAP (Time-Weighted Average Price) feeds (and why #Fringe does not use them) is that they originate from DEXs.
A DEX like @Uniswap 🦄 enables the permissionless listing of any given asset. This causes some assets, like $INV, to have low volumes...
5/10
...which can then allow traders to, with their activity, manipulate the price.
A manipulated TWAP oracle means, in short, that any platform that uses the oracle will suffer from its manipulation.
To avoid this, using decentralized oracles such as @chainlink's is key.
...which can then allow traders to, with their activity, manipulate the price.
A manipulated TWAP oracle means, in short, that any platform that uses the oracle will suffer from its manipulation.
To avoid this, using decentralized oracles such as @chainlink's is key.
6/10
It's no coincidence that, after the exploit, Inverse announced it'd be replacing its TWAP feeds through a collaboration with Chainlink.
However, there's something else a protocol can do to protect itself from such an attack: To make it unprofitable.👀
It's no coincidence that, after the exploit, Inverse announced it'd be replacing its TWAP feeds through a collaboration with Chainlink.
However, there's something else a protocol can do to protect itself from such an attack: To make it unprofitable.👀
7/10
Fringe Finance has special protections in place that make these attacks too costly to execute.
This works by including a maximum aggregate borrowing capacity for any given collateral asset, based on the overall market liquidity for that asset.
Fringe Finance has special protections in place that make these attacks too costly to execute.
This works by including a maximum aggregate borrowing capacity for any given collateral asset, based on the overall market liquidity for that asset.
8/10
Therefore, tokens with low market liquidity, which could otherwise have their price manipulated, could not be used to take out high enough loans. Even if using TWAP feeds.
In other words, manipulating a single asset's price would NOT guarantee a borrower a juicy return.
Therefore, tokens with low market liquidity, which could otherwise have their price manipulated, could not be used to take out high enough loans. Even if using TWAP feeds.
In other words, manipulating a single asset's price would NOT guarantee a borrower a juicy return.
9/10
This simple limitation cuts out the incentive to attack, vastly increasing its difficulty.
As you know, Fringe is committed to being one of the most secure platforms in #DeFi. As such, our intention with this thread is to inform users of good practices to look out for.
This simple limitation cuts out the incentive to attack, vastly increasing its difficulty.
As you know, Fringe is committed to being one of the most secure platforms in #DeFi. As such, our intention with this thread is to inform users of good practices to look out for.
10/10
Regardless of whether a given project is a "competitor" or not, DeFi's success is everyone's success. We wish nothing but to see this industry become as secure as it should be in these initial stages. DeFi is for everyone.
What good practices would you like to see more?
Regardless of whether a given project is a "competitor" or not, DeFi's success is everyone's success. We wish nothing but to see this industry become as secure as it should be in these initial stages. DeFi is for everyone.
What good practices would you like to see more?
• • •
Missing some Tweet in this thread? You can try to
force a refresh
