Cyber Defense eMagazine July Edition for 2022

Take the Deus Finance exploit as an example, which saw an attacker drain close to $16 million USD in
funds. While Deus did have their smart contracts audited, an attacker was able to target a new unaudited
smart contract with a sophisticated flash loan attack. Though this attack, the hacker was able to change
the price of Deus' DEI tokens and reap the benefits of this predictable price action. They did so by
manipulating a lending pool that was used by the oracle - a node of code which interprets data - that
dictated the price of the token.
Now, any smart contract worth its coin would warn you of the dangers of using an oracle that determines
a price by using a trading pair as these can be easily manipulated. However, since the vulnerable smart
contract was outside the scope of the initial audit, auditors were not given a chance to highlight the
problem.
Deus should serve as a clear warning to projects that they must treat smart contract audits as an ongoing
feature in their security framework and have them audited every time a significant change is made to the
project. Yet, not all audits are equal. Time and again we see well-planned projects suffer from the flaws
of bad auditing.
Take the recent FEG exploits as an example. The FEG (Feed Every Gorilla) hyper-deflationary
governance meme token was recently hit by two flash loan attacks which collectively drained $3.2 million
USD in funds from the protocol over the course of two days.
In each attack, the hacker (or hackers) targeted the same vulnerability in FEG’s smart contract. CertiK’s
analysis of the exploit discovered that this was due to a flaw in the token’s Swap-To-Swap function, which
directly takes user input “path” as a trusted party without any sanitations. In simple terms, this flaw allowed
the hacker to repeatedly call functions that allowed them to gain unlimited allowances and drain the
contract of its assets.
Perhaps most frustratingly for FEG, this flaw should have been detected by a smart contract audit. Even
though FEG did have their smart contracts audited, the auditors should have noticed that FEG’s untrusted
“path” parameter is passed to the protocol and approved for spending assets of the contract. Any good
audit would then flag this as a major severity and advize the project to act and edit accordingly.
There is a lesson to be learned here for the crypto-security industry– that, as hackers continue to find
new and ingenious ways to exploit projects, it is no longer enough for auditors to just update their checks
in response to new attacks. Instead, they must constantly be updating their technology so that when a
new attack happens they are prepared for it.
Both of these exploits highlight not only the need for rigorous and regular smart contract audits, but also
the need for a proactive, consistent, end-to-end approach to web3 security. This amounts to a shift
towards viewing security as something to be built and maintained rather than just a label to be bought
and sold. This applies to the teams who need to be updating their project’s security in tandem with their
Cyber Defense eMagazine – July 2022 Edition 209
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.