NEXUS MUTUAL

DESCRIPTION OF EVENTS

Nexus Mutual is "[a] people-powered alternative to insurance".

"Nexus Mutual uses the power of Ethereum so people can share risk together without the need for an insurance company." "Nexus Mutual is run entirely by its members. Only members can decide which claims are valid. All member decisions are recorded and enforced by smart contracts on the Ethereum public blockchain."

The fund claims it "will always put the security of our protocol and the safety of our members funds above anything else." "The Mutual’s code was audited by the Solidified team in April 2019 prior to its mainnet launch back in May."

"On February 20th, the core team received [a] report from renowned security researcher Samczsun outlining a vulnerability that could put a significant portion of the mutual’s funds at risk." "[T]he vulnerability allowed any third party to trigger a treasury rebalance at any point in time."

"The mutual’s funds are currently held entirely in DAI and ETH. Whenever a claim is accepted, the mutual must ensure enough funds in the corresponding asset are available to pay out the claimant. If the amount being paid exceeds a certain threshold, the protocol exchanges the required amount in several batches with a time delay in-between. With this, the system relied on Oraclize to trigger the rebalance via Uniswap."

"We do acknowledge that there have been warnings against using Uniswap in this way and it is known to be susceptible to this type of attack. The bZx hack should have been a huge red flag for us as well, but we were overwhelmed by our product being put to its first real test to successfully pay a claim."

"Within 4 hours of receiving the report, the Mutual kill switched the system’s interaction with Uniswap, disabling the ability to execute this exploit." "[I]f any [immediate] claims in Dai are to be paid, Nexus Mutual will raise governance proposals to transfer the required ETH to the advisory board multi-sig, exchange them for Dai, and pay the underlying claim. In the longer-term, Nexus Mutual is aiming to integrate with a manipulation-resistant DEX and are currently evaluation options."

"Samczsun will receive a $5,000 bounty for his disclosure. The threat matrix categorized the vulnerability as a high severity issue given its potential impact and medium likelihood of being executed." "With the recent disclosures, Nexus Mutual has decided to launch a bug bounty program in the near future." "We are working on comprehensive fixes that require contract upgrades and further security reviews."

Explore This Case Further On Our Wiki

Nexus Mutual initially launched with a critical vulnerability which put the funds at risk. This was resolved before it could be exploited.

HOW COULD THIS HAVE BEEN PREVENTED?

No user funds were lost.

Check Our Framework For Safe Secure Exchange Platforms

Example Domain (Mar 23)
List of Ethereum Smart Contracts Post-Mortems - Security - OpenZeppelin Community (Jun 23)
Responsible Vulnerability Disclosure (Jun 23)
Nexus Mutual | A decentralised alternative to insurance (Jun 25)
Nexus Mutual Whitepaper (Jun 25)
Nexus Mutual Discloses Security Vulnerabilities - Transparent DeFi Update (Jun 26)
@NexusMutual Twitter (Jun 26)
@samczsun Twitter (Jun 26)
DeFi Insurance Firm Nexus Mutual Makes Its First Payout Following bZx Attacks - CoinDesk (Jun 21)
audits/Audit Report - Nexus Mutual [22.04.2019].pdf at master · solidified-platform/audits · GitHub (Jun 26)

More case studies

Authereum
Metatransactions Order

Coinbase Sim Swapping
SaltedAvocadosMhh