QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
UNKNOWN
JUNE 2022
GLOBAL
RIBBON FINANCE
DESCRIPTION OF EVENTS
"SUSTAINABLE ALPHA FOR EVERYONE" "Earn yield on your cryptoassets with DeFi's first structured products protocol." "Ribbon Finance is a new protocol that helps users access crypto structured products for DeFi. It combines options, futures, and fixed income to improve a portfolio's risk-return profile."
"Theta Vault, which is a yield-focused strategy on ETH and WBTC. The vault earns yield on its deposits by running a weekly automated options selling strategy. The vault reinvests the yield earned back into the strategy, effectively compounding the yields for depositors over time."
"Ribbon's v1 and v2 Theta Vault contracts are audited. Despite the audits and security measures we have taken, we advice users to exercise caution and to not risk funds they are not willing to lose." Audits were found provided by Quantstamp, ChainSafe (2 audits), Peckshield, and OpenZeppelin. "We have an ongoing bug bounty on ImmuneFi, with up to $50,000 of bounty. The contracts that are included in the bounty are ETH and WBTC Theta Vaults."
HOW COULD THIS HAVE BEEN PREVENTED?
The issue ultimately stemmed from a single customer support agent being compromised. A multi-signature requirement on DNS changes would have prevented this scenario entirely.
While NameCheap offers advanced protections on their domain names, this service had just launched two days prior to the DNS change, so it was unlikely to be a reasonable expectation that Convex Finance would have already signed up.
Users of platforms need to be careful and double check any new approval requested by any platform against the proper smart contract address. It is recommended to double check any new smart contract addresses being interacted with.
Ribbon Finance: Crypto structured products on Ethereum (Oct 13)
Introduction to Ribbon - Ribbon Finance (Dec 5)
Security - Ribbon Finance (Dec 5)
audit/PeckShield-Audit-Report-Ribbon-v1.0.pdf at master · ribbon-finance/audit · GitHub (Dec 5)
audits/Ribbon-Audit_April-2021.pdf at main · ChainSafe/audits · GitHub (Dec 5)
audit/Quantstamp Theta Vault.pdf at master · ribbon-finance/audit · GitHub (Dec 5)
audit/RibbonThetaVault V2 Smart Contract Review And Verification.pdf at master · ribbon-finance/audit · GitHub (Dec 5)
Ribbon Finance Audit - OpenZeppelin blog (Dec 5)
https://www.cloudflare.com/learning/dns/what-is-dns/ (Feb 9)
Post Mortem Of Events June 23 (Aug 24)
@ConvexFinance Twitter (Aug 24)
Premium domain protection – Domain Vault - Namecheap (Feb 9)
@NamecheapCEO Twitter (Aug 24)
@DevanCollins3 Twitter (Aug 24)
@NamecheapCEO Twitter (Aug 24)
@LefterisJP Twitter (Feb 10)
@NamecheapCEO Twitter (Feb 11)
