QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
$48 000 USD
APRIL 2020
GLOBAL
HEGIC EXCHANGE
DESCRIPTION OF EVENTS
"Hegic is an options protocol taking a fresh approach to minting and trading options." "Trade non-custodial options for profits or to hedge your positions. Enjoy fixed price and unlimited upside of the options contracts. No registration, KYC or email required.". "Traders and holders can use options on Hegic to insure against price volatility. Consider ETH is worth $500, and a user buys an option contract, which enables them to sell one ETH for 500 DAI within some time window. If ETH price tanks to $400, the user can safely exercise the contract, liquidating their position for 500 DAI." "Hegic Protocol V1 code has been audited by @trailofbits. Security audit includes HegicOptions, HegicCallOptions, HegicPutOptions, ETHPool and ERCPool contracts."
"Hegic made its debut on the mainnet on 23rd April 2020, hours after going live, they claimed to have a bug in the smart contract. The bug locked user funds into expired options contracts, rendering them permanently inaccessible. Up to $48,000 worth of funds were forever locked up in the platform’s smart contract." "All found issues were fixed and now IT IS MUCH SAFER TO USE THE CONTRACTS!"
"The options platform Hegic wasn’t attacked by anyone, yet a typo in the project’s code led to freezing users’ assets." "It’s NOT a security issue. It’s an incorrect function name (optionIDs instead of optionsIDs). This function unlocks liquidity in expired contracts. If it doesn’t work, funds are just forever locked. It can’t be used by a malicious actor. @trailofbits did their job well."
"Trail of Bits was not so happy that Hegic claimed they had “audited” the smart contract. CEO Dan Guido asked them in a tweet: “Please stop holding up a 3-day code review as an ‘audit’ that proves the code is safe.”"
"Hegic’s founder reimbursed everyone who suffered."
"As the liquidity is [forever] locked on the old contracts with a bug, all the LPs who have suffered losses due to the bug have received a 100% refund. Those who have closed their options early, have also received a 100% refund. $47,765 in total was paid out to LPs & holders."
Customer funds on the Hegic Exchange platform were locked up due to a typo in the smart contract. The platform had requested a code review by an auditing firm, and that firm failed to notice the issue at the time.
In the end, the amount lost was not that significant (compared to other incidents) and was fully reimbursed by Hegic.
HOW COULD THIS HAVE BEEN PREVENTED?
Smart contracts are generally too complex to prove that they are error-free. Storage in offline multi-signature wallets is generally simpler and possible to validated. It's important to always test that wallets are set up correctly.
Crypto Hacks 2020: A Comprehensive List - ImmuneBytes (May 18)
Millions Lost: The Top 19 DeFi Cryptocurrency Hacks of 2020 | Crypto Briefing (May 22)
@HegicOptions Twitter (May 23)
Hegic: New Age Options Trading Protocol | Crypto Briefing (May 24)
Hegic: On-chain options trading protocol on Ethereum (May 24)
@HegicOptions Twitter (May 24)
@HegicOptions Twitter (May 24)
publications/hegic-summary.pdf at master · trailofbits/publications · GitHub (May 24)
Hegic Analysis Report: Non-Custodial Options Protocol | Albaron Ventures (May 24)
@HegicOptions Twitter (May 24)
The dForce and Hegic DeFi exploits, and why Smart Contracts are bad – Attack of the 50 Foot Blockchain (May 24)
@HegicOptions Twitter (May 24)
@dguido Twitter (May 24)
Defi Sharing The Risks Rewards And Responsibility (May 24)
DeFi Security: With So Many Hacks, Will It Ever Be Safe? - Unchained Podcast (May 24)
SlowMist Hacked - SlowMist Zone (May 18)
Hegic Exploit · GitHub (Jun 23)
List of Ethereum Smart Contracts Post-Mortems - Security - OpenZeppelin Community (Jun 23)
CRYPTO ANONSENSE [Book] (Jul 29)
Hegic Unlock Function Bug or Three DeFi Development Mistakes That I Feel Sorry About - XRP Ripple FAN (Jul 29)
DeFi Bug Freezes $30,000 of Ether Forever | Crypto Briefing (Jul 29)
No Title (Jul 29)
Blockchain Hacks: 2020 | $15 billion lost, how can we mitigate hacks in 2021? | CertiK Foundation Blog (Jul 23)
Examining Decentralized Options Platforms - Deribit Insights (Jan 15)
Security Risks in Ethereum DeFi | ConsenSys Codefi (Nov 15)
