LIEN FINANCE

DESCRIPTION OF EVENTS

Lien Finance describes itself as a "protocol for creating options and stablecoins out of ETH". "The three core features of LIEN are Tokens (iDOL, LBT, SBT, LIEN), DEX (FairSwap), and the Lien protocol." "The Lien Protocol is the smart contract that makes the bifurcation (tranching) of ETH into a stable coin and a call option possible." "Users can create, trade, and use stable coins and options created from ETH, without worrying about counterparty risk." "Lien aims to eliminate all aspects of governance and centralization of authority." The contract "has been certified by the CertiK audit team and can be confirmed on page 10 of the CertiK audit report."

"On September 15, 2020," a developer Samczsun "noticed that there was a bug within the smart contract with a loophole that contained about 25,000 ETH, which at the time was worth around $9.5 million. Samczsun could easily have taken advantage of this and could drain the contract, but sought the developers of Lien Finance to rectify the bug."

"Realistically, there were two ways the situation could’ve been resolved. First, Lien Finance could’ve publicly disclosed the vulnerability, but that would’ve created a perfect opportunity for hackers to snatch the funds—like placing a “free money” sign."

"Second, the whitehat team could’ve exploited the smart contract itself and then return the funds to their rightful owners. But this would’ve definitely attracted the so-called generalized frontrunner bots—apex predators of Ethereum’s mempool."

"Basically, frontrunners could automatically copy any transaction in the mempool, replace its addresses with their own and make sure that the duplicate operation gets picked up by miners first. In the current situation, that meant $10 million could’ve been easily stolen by frontrunners in a matter of seconds. Secrecy was essential."

"At this point, Sam and Bigelow were finishing the script to generate 4 sequential signed transactions. Processing them in order would not withdraw the ETH 25,000, wrote Bigelow, but would transfer the "falsely" created 30,000 Stable Bond Token (SBT)+Liquid Bond Token (LBT) tokens to the Lien team, subsequently allowing them to submit the final transaction to convert these tokens back into ETH."

"Sparkpool was enlisted by Samczsun to execute the hack on the $10 million Ethereum wallet. This was performed hitch-free and the Ethereum token was passed through Sparkpool and into the Lien wallet after which Lien developers patched the code."

"On September 22, Lien announced that the team had notified them of a bug in the "BondMaker" program, which the protocol said is an integral part of the Lien app. Stating that no funds were lost in the 'rescue' process, and describing that process in detail, Lien said that, once they confirmed that the users’ funds were no longer at risk, they shut down the frontend of the Lien app and notified the community of the incident. They immediately moved on to "tabulating everyone’s balances and made all efforts to return their funds as soon as possible.""

"We have important information that we need to share with the users of the Lien app." "Our code auditors notified us today that they had identified a bug in one of the programs." "No funds have been compromised." "Addresses that held iDOL, LBT, SBT, and LP shares on September 16, 2020 11:07:43 AM UTC will be getting back their funds in ETH." "The amount of ETH they will be receiving will be based on the value of the iDOL, LBT, and SBT calculated by the protocol as of that cut off timing." "The payments will be processed as soon as possible." "Considering the nature of the matter and the urgency involved, we had to wait to make the announcement until we made sure the funds were safe."

As of September 18th, they'd started processing the payments. "Please check your addresses that held iDOL, SBT, LBT, or LP shares at September 16, 2020 11:07:43 AM UTC." "The entire process is expected to take around 6-12 hours." "Refund payments have been completed." "On September 19, 2020, at 21:45 UTC, we completed the refund payments to users."

Lien Finance offers some interesting financial products, including an advanced structure of stable coin.

A highly experienced developer found an exploit in the smart contract which had been overlooked by the contract auditor. Rather than exploiting it himself, he attempted to get in touch with the auditor and the project (which was run anonymously). He succeeded.

The transaction was broadcast directly to a mining pool in order to avoid the exploit being stolen from the mempool.

HOW COULD THIS HAVE BEEN PREVENTED?

Decentralized finance is a new field, and it is impossible to prove security of funds.

For the time being, safer storage of platform funds would be multi-signature offline wallets, where they can't be subject to exploits.

Check Our Framework For Safe Secure Exchange Platforms

Rescuing USD 9.6 Million in Ethereum: The Fellowship of a Smart Contract (May 16)
Lien Finance Homepage (May 22)
Whitehat hacker finds a $10M Ethereum vulnerability and reports it (May 23)
Escaping the Dark Forest (May 23)
@samczsun Twitter (May 23)
Hacker Saves $10 Million in Ethereum From Inevitable Theft - Decrypt (May 23)
Lien Smart Contract CertiK Audit Results Overview (May 23)
CertiK Audit Report - Lien Finance (May 23)
An introduction to Lien Finance & trustless stablecoins | TokenBrice - Blog (May 23)
@LienFinance Twitter (May 23)
@LienFinance Twitter (May 23)
Interruption of Service Incident Analysis (May 23)
Millions Lost: The Top 19 DeFi Cryptocurrency Hacks of 2020 | Crypto Briefing (May 22)
Ethereum (ETH) Ethash | Mining Pools (Jun 27)
https://mobile.twitter.com/certik_io/status/1295382678485839873 (Jan 10)

More case studies

bZx DeFi Protocol
Hacked Again

Bantiample
Exit Scam