88MPH

DESCRIPTION OF EVENTS

"88mph is a fixed-rate yield-generation protocol." "88mph is a fixed-rate yield-generation protocol on Ethereum that allows users to deposit assets, earn fixed-rate interests, and farm for MPH tokens." You can "lend your crypto assets at a fixed interest rate or buy some floating-rate bonds. By doing so, you earn upfront $MPH token and system rewards." "Earn fixed-rate interest on your crypto and MPH rewards." "[L]end your crypto assets at a fixed interest rate with infinite liquidity." "The first mainnet version was launched in April 2020." The team "started working on a new version of the protocol in June and did [their] first security audit at that time, with the help of an Aave grant."

"88mph protocol is controlled by the MPH community who have the power to shape the future of the protocol. the governance treasury receives the MPH tokens paid back by depositors when they withdraw their deposits. The MPH community can propose and vote on various proposals ranging from protocol parameter changes to smart ways of using the capital assets stored in the treasury for creating new incentives, capitalization, and at the end growth."

88MPH had been audited by PeckShield on January 11th, 2020.

"On 7 June 2021, Ashiq Amien, a security researcher at iosiro, identified a critical bug in the fixed-interest-rate lending protocol 88mph." "The initialization bug was identified in 88mph's NFT contract, and resulted in allowing anyone to claim ownership of the contract and steal the underlying assets."

"The vulnerability was an unprotected init() function in the code of these specific pools that would have allowed a malicious user to steal $6.5m in tokens, mostly in crvRenWBTC." "The vulnerability affected three pools: yaLINK, CRV:STETH, [and] CRV:RENWBTC." "At the time of the disclosure, an attacker would have been able to steal over $6.5 million USD of user assets from the protocol."

"The init() function, which is used to initialize the NFT contract on 88mph’s platform, was missing an onlyOwner modifier, and there was also no initializer modifier to prevent a re-initialization. In other words, the init() function was unprotected and was callable multiple times — and by anyone. The result of this unprotected function was that anyone could have taken ownership of the NFT contract, and ownership came with the privilege of minting pool deposit NFTs and burning any user’s NFT deposit using the mint() and burn() functions. This vulnerability would have allowed a malicious attacker to have access to any user’s NFTs and deposits."

"The bug was reported to 88mph through Immunefi." "The 88mph team responded quickly after receiving the disclosure, restricting access to the vulnerable functionality within 2 hours and extracting the funds to the treasury within 24 hours." "88mph quickly paused the affected contracts, whitehacked all user funds, and returned those funds to their rightful owners after they had been saved."

"During the assessment phase, Duncan Townsend, CTO of Immunefi, reviewed the code and suggested that 88mph pause the contracts by 1) deploying a dummy minter contract that reverted on every call, and 2) setting the minter to that contract. This pause method prevented frontrunning the whitehack and bought enough time to carefully capture all the funds and transfer them to the 88mph multisig wallet. The whitehack was executed on June 8th at 9:46pm UTC."

"The bug was reported to 88mph through Immunefi for a bounty of $42,069." "In recognition of the vulnerability’s potentially devastating impact, 88mph is awarding iosiro a bounty of $42,069 at the request of the whitehat."

The audited 88MPH smart contract hot wallet was storing $6.5m in funds. There was an error in the smart contract which allowed anyone to initialize the contract, thereby granting themselves the mint and burn functionality.

This was discovered by a white hacker before being exploited. As a result, all funds were safe and a bounty was issued.

HOW COULD THIS HAVE BEEN PREVENTED?

Smart contracts are a form of hot wallet, and not as secure as cold storage. The issue remained despite professional auditing, which is an important illustration of how hot wallet systems cannot be proven secure.

In general, cold storage with a proper multi-signature wallet held by trained and background checked individuals is a more secure method of storage.

Check Our Framework For Safe Secure Exchange Platforms

Critical Bug Identified in 88mph Awarded with $42,069 Bounty | iosiro (Jul 13)
88mph (Jul 13)
88mph launch . Back to the future of DeFi — Monday… | by McFly | 88mph | 88mphapp | Medium (Jul 13)
88mph - Fixed Interest Rate Lending Protocol (Jul 13)
88mph | Stats, Charts and Guide | DeFi Pulse (Jul 13)
88mph Function Initialization Bug Fix Postmortem (Aug 15)
Ethereum Transactions Information | Etherscan (Aug 15)
Peckshield Smart Contract Audit Report - 88MPH (Aug 15)

More case studies

MetaMask Wallet Cleaned
Out echodelta79

PolyGold
Finance Exits