$19 759 000 USD

NOVEMBER 2020

GLOBAL

PICKLE FINANCE

DESCRIPTION OF EVENTS

"Pickle came on the scene Sept. 11 as one of many food-themed DeFi projects." "Pickle Finance is a yield aggregation service that rewards users who provide liquidity to its various pools of stablecoins with interest and token disbursements in ether, other stablecoins or its native digital asset PICKLE." "The project attempted to bring price stability to the four top stablecoins, DAI, USDC, USDT and sUSD, which are frequently knocked off their dollar peg." "Pickle Finance shifts investors’ money around different DeFi protocols to maximise returns, a little like a traditional robo-advisor. " "On 2020–11–21 06:37 PM (UTC), Pickle’s pDAI PickleJar was hacked and 19,759,355 DAI was drained."

 

"This was a very complicated attack and involved many components of the Pickle protocol." "Shortly after the security breach and loss of nearly $20 million in DAI, Pickle’s administrators engaged with cybersecurity specialists to tackle the situation." "After many hours, the team (now totalling more than 10 people) finally figured it out how it was executed."

 

"The attacker swapped funds between a malicious copycat contract and Pickle cDAI Jar (Pickle’s yield-bearing vault) thus leading to the loss of funds." "Pickle Finance focused on providing an automatic solution for moving funds between various DeFi protocols in order to maximize profits. Hence, they required depositing funds in Compound as a kind of “common ground” for trading and arbitration." "[T]he attacker created “bad jars,” —contracts with a similar interface to the “good jars” but programmed differently. The attacker then exchanged funds between his “bad jar” and the real cDAI Jar, taking the $20 million in deposits."

 

"At the moment the money stolen from the hacker is still in the dormant wallet and yet to be laundered to various exchanges. As expected following news of the hack, Pickle Finance native token (PICKLE) suffered a dip losing more than 50% of its value in a few hours." "Pickle Finance said in a Nov. 24 tweet that it has a “small chance” of recovering the stolen money." "Although this avenue has a small chance of recovering the lost funds, we will not be issuing any IOU tokens so as to not impede the growth of this protocol going forward."

Pickle suffered a complex attack, which can be expected when many different systems are working together and there's a very strong incentive to break in.

 

In this case, the Pickle Finance team has not made any efforts to make right on what happened, so affected users are out the entire value of their funds.

HOW COULD THIS HAVE BEEN PREVENTED?

Decentralized smart contracts are effectively hot wallets. The right mistake in the coding can provide a hacker with access to any funds under the control of the contract.

 

One of the key advantages of centralized platforms is that withdrawals which are obviously suspicious can be prevented.

 

Check Our Framework For Safe Secure Exchange Platforms

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.