Hackers Target Centralization, So DeFi Should Stick To Its Own Game

In May 2021, the amount of funds locked globally into the decentralized finance, or DeFi, ecosystem stood at almost $89 billion. Formerly a dark horse of the fringe of the cryptoverse, DeFi soared in late 2020 and in the first months of 2021. Where money flowed, whales followed, with institutional players joining the DeFi fray in growing numbers. 

Bad guys were paying attention too. In 2020, DeFi hacks and thefts made up about half of all blockchain-related incidents despite being virtually non-existent in 2019, according to CipherTrace. Nothing is new about hackers capitalizing on a lucrative industry. For DeFi developers and cybersecurity practitioners alike, however, there are notes to be taken and lessons to be learned. And one of the key takeaways should be this: To be more secure, DeFi needs to become actually decentralized.

Playing the system by its laws

Smart contracts, self-executing application managing assets and transactions, took off with the release of Ethereum in 2015, which remains the largest platform for DeFi projects. There, these applications are written in Solidity and run on the Ethereum Virtual Machine (EVM) runtime environment. Smart contracts serve as DeFi’s operational backbone, enabling loans, cryptocurrency swaps, insurance, and various other services. Code is the law here: Once a contract is uploaded on the blockchain, it is executed and cannot be edited.

For a DeFi project, botching a smart contract is like opening a bank with a rusty and hole-ridden vault. As such, it is hardly surprising that a staggering number of attacks on DeFi services utilized various flaws and vulnerabilities within smart contracts.

Some of the attacks we saw recently exploited DeFi’s programmatic vulnerabilities, such as integer over- and underflow attacks. Such attacks leverage the way EVM and Solidity handle integer variables to deliver outcomes that are not foreseen by the developers. The 2018 batchOverflow vulnerability, which prompted multiple exchanges, including OKEx, Poloniex, and Changelly, to temporarily suspend ERC-20 token deposits in 2018. The problem came down to a mistake in a smart contract’s batch transfer function, which could have been used to send a gargantuan amount of tokens to another address without charging the sender’s wallet. 

In 2020, Lendf.Me and Uniswap lost a total of $25 million on a hack that exemplified another key attack target: logical flaws in smart contracts. The attacker used a logical flaw in the ERC777 token contract to effectively create an artificial collateral and empty Lendf.Me’s lending pools, also affecting Uniswap. The flaw in question boiled down to a reentrant function. If a process can be interrupted mid-way and initiated again, with both instances eventually completed, it is called reentrant. A reentrant function in a smart contract allows a malicious actor to potentially call it over and over. If this happens to be your withdrawal function, your entire wallet can be emptied within minutes.   

The use of flash loans, uncollateralized loans that must be paid off in the same transaction, was a key component in many attacks that were aimed at data oracles—services that feed off-chain data, such as asset prices, into smart contracts. These often rely on a single data source, such as a crypto exchange. Using a flash loan, a savvy malicious actor can manipulate its spot prices and set off a sequence of transactions that eventually allows the hacker to take off with the gains.   

On a more positive note, many of the attacks above ultimately stem from the relative immaturity of the DeFi ecosystem. As it evolves and develops mature security protocols, they will go on a decline. One of those could be the use of decentralized oracles, oracles services tapping into more than one source for data. And this brings us to the elephant in the room: DeFi’s lack of actual decentralization.     

It’s all in the keys

While the rise of the DeFi ecosystem has naturally given rise to new and sophisticated attack vectors, an old and proven security truth still very much goes for it. Namely, your private key is still your most prized possession, and by getting a hold of it, hackers can get very rich.

Here is how this works in the DeFi ecosystem. For a contract to go live, it has to be uploaded on the blockchain. When doing so, companies normally set up the contract owner, which is usually the wallet that uploads the contract on the blockchain.

Much like a system administrator on a regular network, this wallet will then be able to call functions and use features inaccessible to a regular user. Since smart contracts can hold funds, the owner would usually have at least some access to those. While providing any given DeFi service with the administrative functionality it needs, ownership makes for not just a major vulnerability, but, effectively, a betrayal of the “De” in DeFi. 

A number of recent hacks, including the attacks on EasyFi platform, Paid Network, and, apparently, the Roll, all saw hackers compromise the private keys powering the DeFi solutions. This allowed them to make it off with gains of up to $80 million, as in the case with EasyFi. An earlier hack of the Bancor Network, where hackers were able to get their hands on a private key to a crucial account within the decentralized exchange’s system, also fits into this category.

The exchange was able to freeze the malicious transfer of its native BNT tokens using the token smart contract. Sounds good, right? The implication, though, is that had the malicious actor taken over the token contract, they could have frozen all BNT transfers, effectively nuking the entire DeFi service. That is as centralized as it gets.

These attacks force us to reckon with a simple truth: DeFi, for all its flair and novelty, is not as decentralized as its own name suggests. A chain is as strong as the weakest link, and the same goes for blockchain. While DeFi smart contracts run on the blockchain, a distributed environment, the private key is still its single point of failure.

A contract owner not taking good care of their private keys leaves the door open to an attack that could wipe out the entire service. A bank looking to tap the DeFi rise can have its accounts emptied if it does not protect its smart contract private key with the same rigorous measures kept for usual transfers, such as cold vault and MPC. Thus, aspiring DeFi movers and shakers must never forget the very first lesson for everyone entering the cryptoverse—when it comes to your private keys, security is everything.