[Music]
we
have why one oh hey everyone now it's
working I'm going to tell you about one
of my favorite issues and and I will
show you how I was theoretically able to
steal $1.1 million in 15 minutes so how
the story started few months ago I was
browsing the interesting uh applications
on the blockchain and I found very
interesting Landing lending Market they
were offering
82% uh returns in usdc in Stables so a
crazy good deal so there's something
wrong with this or is the best deal ever
or is it scam I decided to check it so I
did what I do the best and I started to
checking the source code fortunately it
was open source so I checked everything
uh how the platforms works if they're
really having the loans or not and I
decided in the end to verify all the
loans collaterals Dept in the system so
um in the lending Market the important
thing is healthy and unhealthy loan so
basically uh when you take a loan you
need to give some collateral so let's
say you want want to borrow $50 you need
to give $100 of collateral and whenever
the debt becomes too high let's say you
know it it gross by 20% because value of
token went up the platform need to
liquidate uh the loan because uh if it
didn't then there's just not enough
collateral to pay for the loan most of
the platforms um usually require pretty
high collateral in this case let's
assume it was one two: one ratio so if I
want to borrow $100 I need to give $200
doar in
collateral okay so I created a simple
script uh to verify all the loans assets
and collaterals everything was fine with
the platform but I decided to go even
deeper
so what I noticed is that the platform
was very complex they have very complex
Logic the liquidation the flesh loans uh
support for very untypical loans support
for multiple assets and from my
experience as an auditor I quickly
notice it's very easy to make a mistake
especially with liquidation process so I
already was able to see some low
severity issues and I decided to dig
deeper if I can achieve something more
with them and the most interesting part
was liquidation of unhealthy loan
because it worked like a flesh loan if
you want to liquidate the loan first you
get a collateral then um you and then
you repay the depbt in this by the in
the end of the transaction so it works
like the flash loan you get token X but
you are forced to repay the token EG uh
by the end of the transaction so this
kind of logic is very complex it's very
easy to make a mistake so I started to
search okay how can I abuse it to find
some critical to get some critical issue
and there was another very complex thing
which was linked loans basically you are
able to have multiple loans for a single
collateral the reason was you know you
want to have a loan for a different
things you can have it so we just create
one account with all the collateral and
then create multiple loans linked to
it and the important part was how to
create a linked Clan so you could do it
by creating a new empty loan with by
with no collateral and then you you are
you linked it to the other loan which
already had collateral but I I noticed
they only check if the loan has no
collateral they didn't check if loan has
any depbt so that may be a an issue but
the question is is it even possible to
create a loan with only Dept and no
collateral and actually there is you
know this liquidation process from
before I noticed that this is the only
place which is taking the collateral
from the loan and then um for a moment
the collateral is lower lower than it
should be of course uh in in normally
the collateral is pretty high so you
cannot take everything but here's where
where they made made the mistake they
allowed to start multiple liquidations
of the same Loan in the same transaction
so I was able to start liquidation twice
and create a loan which has for a moment
no collateral this transaction would
fail because um then when the then I
when I would like to repay $100 of debt
there wouldn't be
uh enough depbt in a smart contract to
actually repay it so the transaction
would would fail but fortunately I mean
unfortunately for them I found a way to
fix this issue so the idea is okay I
have too much depbt which I need to
repay so to fix it I simply need to take
after linking this loan uh to another
one I simply need to take more depth and
then by the end of transaction when I
try to repay $100 of depbt it's possible
so I managed to make this transaction
work and what does it accomplish so
first of all I amble I'm able to link a
loan which has only adapt to another one
and the problem with this is they assume
they assume that this loan which I'm
linking has no Dept so whenever whenever
I was uh whenever I was repaying linking
the loan the dept wasn't added to the
master loan
however when I was repaying this
repaying the debt it was being removed
from the mother loan Master loan so in
the end by doing this complex
transaction I was able to remove some
depth from the system uh from the master
loan so with every transaction I was
able to steal some amount of the money
so now I knew I had exploit I decided to
code it spend the next 30 30 hours
basically during the two days to write
the exploit it was hard than expected
because they had a lot of Runing issues
so it wasn't so simple to um to to um
remove all collateral to be exactly zero
but they managed to do it so when I run
the exploit it was of course on a testet
which I I created by copying the main
database in 15 minutes by doing 1,000
transactions I was able to extract
everything and yeah it was $1.1 Million
so 15 minutes and of course then I
contacted
there yeah
and then I contacted the project and we
fixed the issue so it worked well for
everyone and then I put a lot of money
there because the returns were crazy
high so last thing my recommendations to
how to avoid this first of all don't go
into such complex logic if you don't
need to keep your projects as simple as
possible especially if you can't test
something just don't write it um have a
developer with uh experience in cyber
security of course they can audit have a
bounty program they didn't but I
contacted them on Telegram and we we've
found out the way how to cooperate on
that okay write write as many tests and
use platforms which um which can help
you to stop attacks uh if if they can be
detected so uh if you would like to talk
more about this issue I have La top with
me we have talk an hour about this
because it was quite more complex than
I'm showing here then feel free to catch
me I'm easy to found so so thank you any
questions
Applause so we are short on time we're
going to take we're going to take one
question it's the flying mic um if a
user is sending earc 20 tokens to a
contract which is not designed to
receive them then these tokens are are
are lost this cannot happen with a ERC
to fre nft or native currency there are
$15 million loss because
of trans problem now do you think
about I don't know what to think about
it I mean I would need more time you
know to see this in details
uh I show details you okay yeah sure
sure we can talk about it in a in a
second okay so another round of applause
for baros time is up