PICKLE FINANCE

DESCRIPTION OF EVENTS

"Pickle came on the scene Sept. 11 as one of many food-themed DeFi projects." "Pickle Finance is a yield aggregation service that rewards users who provide liquidity to its various pools of stablecoins with interest and token disbursements in ether, other stablecoins or its native digital asset PICKLE." "The project attempted to bring price stability to the four top stablecoins, DAI, USDC, USDT and sUSD, which are frequently knocked off their dollar peg." "Pickle Finance shifts investors’ money around different DeFi protocols to maximise returns, a little like a traditional robo-advisor. " "On 2020–11–21 06:37 PM (UTC), Pickle’s pDAI PickleJar was hacked and 19,759,355 DAI was drained."

"This was a very complicated attack and involved many components of the Pickle protocol." "Shortly after the security breach and loss of nearly $20 million in DAI, Pickle’s administrators engaged with cybersecurity specialists to tackle the situation." "After many hours, the team (now totalling more than 10 people) finally figured it out how it was executed."

"The attacker swapped funds between a malicious copycat contract and Pickle cDAI Jar (Pickle’s yield-bearing vault) thus leading to the loss of funds." "Pickle Finance focused on providing an automatic solution for moving funds between various DeFi protocols in order to maximize profits. Hence, they required depositing funds in Compound as a kind of “common ground” for trading and arbitration." "[T]he attacker created “bad jars,” —contracts with a similar interface to the “good jars” but programmed differently. The attacker then exchanged funds between his “bad jar” and the real cDAI Jar, taking the $20 million in deposits."

"At the moment the money stolen from the hacker is still in the dormant wallet and yet to be laundered to various exchanges. As expected following news of the hack, Pickle Finance native token (PICKLE) suffered a dip losing more than 50% of its value in a few hours." "Pickle Finance said in a Nov. 24 tweet that it has a “small chance” of recovering the stolen money." "Although this avenue has a small chance of recovering the lost funds, we will not be issuing any IOU tokens so as to not impede the growth of this protocol going forward."

Pickle suffered a complex attack, which can be expected when many different systems are working together and there's a very strong incentive to break in.

In this case, the Pickle Finance team has not made any efforts to make right on what happened, so affected users are out the entire value of their funds.

HOW COULD THIS HAVE BEEN PREVENTED?

Decentralized smart contracts are effectively hot wallets. The right mistake in the coding can provide a hacker with access to any funds under the control of the contract.

One of the key advantages of centralized platforms is that withdrawals which are obviously suspicious can be prevented.

Check Our Framework For Safe Secure Exchange Platforms

Explained: The DeFi Protocol Pickle Finance Hack (Nov 2020) - Halborn (May 12)
$pickle in a pickle as attacker swipes $20 million in ‘evil jar’ exploit  (May 12)
DeFi Protocol Pickle Finance Token Loses Almost Half Its Value After $19.7M Hack - CoinDesk (May 12)
Pickle Exploit Overview Diagram (May 12)
@vasa_develop Twitter (May 12)
Tidal DeFi Attack User Impact Recap - $20 Million Pickle Finance Hack (May 12)
Pickle Was Hacked And There Has Been A Loss Of Funds (May 12)
DeFi Protocol Pickle Finance Hacked For $20 Million - Decrypt (May 12)
DeFi Protocol Pickle Finance Token Loses Almost Half Its Value After $19.7m Hack (May 13)
evil-jar/readme.md at master · banteg/evil-jar · GitHub (May 13)
Pickle Incident Root Cause Analysis (May 13)
Pickle Finance DeFi Protocol Loses $19.7 Million In DAI Stablecoin in “Massive” Hack | Blockchain News (May 13)
Hacker Steals $20 Million From DeFi Protocol Pickle Finance (May 13)
@picklefinance Twitter (May 13)
@emilianobonassi Twitter (May 13)
CipherTrace Cryptocurrency Crime and Anti-Money Laundering Report 2020 (Jun 20)
SlowMist Hacked - SlowMist Zone (May 18)
Blockchain Hacks: 2020 | $15 billion lost, how can we mitigate hacks in 2021? | CertiK Foundation Blog (Jul 23)
No Title (Aug 3)

More case studies

Blockchain.com
Fake Websites

Celsius GoDaddy
DNS Hijacking