How to steal $1.1M from lending market in 15 minutes by Bartosz Barwikowski | Devcon SEA

[Music] [Music] we have why one oh hey everyone now it's working I'm going to tell you about one of my favorite issues and and I will show you how I was theoretically able to steal $1.1 million in 15 minutes so how the story started few months ago I was browsing the interesting uh applications on the blockchain and I found very interesting Landing lending Market they were offering 82% uh returns in usdc in Stables so a crazy good deal so there's something wrong with this or is the best deal ever or is it scam I decided to check it so I did what I do the best and I started to checking the source code fortunately it was open source so I checked everything uh how the platforms works if they're really having the loans or not and I decided in the end to verify all the loans collaterals Dept in the system so um in the lending Market the important thing is healthy and unhealthy loan so basically uh when you take a loan you need to give some collateral so let's say you want want to borrow $50 you need to give $100 of collateral and whenever the debt becomes too high let's say you know it it gross by 20% because value of token went up the platform need to liquidate uh the loan because uh if it didn't then there's just not enough collateral to pay for the loan most of the platforms um usually require pretty high collateral in this case let's assume it was one two: one ratio so if I want to borrow $100 I need to give $200 doar in collateral okay so I created a simple script uh to verify all the loans assets and collaterals everything was fine with the platform but I decided to go even deeper so what I noticed is that the platform was very complex they have very complex Logic the liquidation the flesh loans uh support for very untypical loans support for multiple assets and from my experience as an auditor I quickly notice it's very easy to make a mistake especially with liquidation process so I already was able to see some low severity issues and I decided to dig deeper if I can achieve something more with them and the most interesting part was liquidation of unhealthy loan because it worked like a flesh loan if you want to liquidate the loan first you get a collateral then um you and then you repay the depbt in this by the in the end of the transaction so it works like the flash loan you get token X but you are forced to repay the token EG uh by the end of the transaction so this kind of logic is very complex it's very easy to make a mistake so I started to search okay how can I abuse it to find some critical to get some critical issue and there was another very complex thing which was linked loans basically you are able to have multiple loans for a single collateral the reason was you know you want to have a loan for a different things you can have it so we just create one account with all the collateral and then create multiple loans linked to it and the important part was how to create a linked Clan so you could do it by creating a new empty loan with by with no collateral and then you you are you linked it to the other loan which already had collateral but I I noticed they only check if the loan has no collateral they didn't check if loan has any depbt so that may be a an issue but the question is is it even possible to create a loan with only Dept and no collateral and actually there is you know this liquidation process from before I noticed that this is the only place which is taking the collateral from the loan and then um for a moment the collateral is lower lower than it should be of course uh in in normally the collateral is pretty high so you cannot take everything but here's where where they made made the mistake they allowed to start multiple liquidations of the same Loan in the same transaction so I was able to start liquidation twice and create a loan which has for a moment no collateral this transaction would fail because um then when the then I when I would like to repay $100 of debt there wouldn't be uh enough depbt in a smart contract to actually repay it so the transaction would would fail but fortunately I mean unfortunately for them I found a way to fix this issue so the idea is okay I have too much depbt which I need to repay so to fix it I simply need to take after linking this loan uh to another one I simply need to take more depth and then by the end of transaction when I try to repay $100 of depbt it's possible so I managed to make this transaction work and what does it accomplish so first of all I amble I'm able to link a loan which has only adapt to another one and the problem with this is they assume they assume that this loan which I'm linking has no Dept so whenever whenever I was uh whenever I was repaying linking the loan the dept wasn't added to the master loan however when I was repaying this repaying the debt it was being removed from the mother loan Master loan so in the end by doing this complex transaction I was able to remove some depth from the system uh from the master loan so with every transaction I was able to steal some amount of the money so now I knew I had exploit I decided to code it spend the next 30 30 hours basically during the two days to write the exploit it was hard than expected because they had a lot of Runing issues so it wasn't so simple to um to to um remove all collateral to be exactly zero but they managed to do it so when I run the exploit it was of course on a testet which I I created by copying the main database in 15 minutes by doing 1,000 transactions I was able to extract everything and yeah it was $1.1 Million so 15 minutes and of course then I contacted there yeah and then I contacted the project and we fixed the issue so it worked well for everyone and then I put a lot of money there because the returns were crazy high so last thing my recommendations to how to avoid this first of all don't go into such complex logic if you don't need to keep your projects as simple as possible especially if you can't test something just don't write it um have a developer with uh experience in cyber security of course they can audit have a bounty program they didn't but I contacted them on Telegram and we we've found out the way how to cooperate on that okay write write as many tests and use platforms which um which can help you to stop attacks uh if if they can be detected so uh if you would like to talk more about this issue I have La top with me we have talk an hour about this because it was quite more complex than I'm showing here then feel free to catch me I'm easy to found so so thank you any questions Applause so we are short on time we're going to take we're going to take one question it's the flying mic um if a user is sending earc 20 tokens to a contract which is not designed to receive them then these tokens are are are lost this cannot happen with a ERC to fre nft or native currency there are $15 million loss because of trans problem now do you think about I don't know what to think about it I mean I would need more time you know to see this in details uh I show details you okay yeah sure sure we can talk about it in a in a second okay so another round of applause for baros time is up