SHARWA FINANCE

DESCRIPTION OF EVENTS

Sharwa.Finance is a decentralized crypto prime brokerage platform launched in 2022, built on Arbitrum and powered by Chainlink. It allows users to engage in margin spot trading and options trading with up to 10x leverage. The platform supports multi-collateral trading, enabling traders to use various assets like USDC, ETH, and BTC without needing to liquidate their holdings. Sharwa.Finance focuses on non-liquidatable positions, meaning traders won’t face liquidations even if the market price drops significantly, as long as their positions are properly hedged with options. It also offers advanced trading tools, such as stop-market, limit, and trailing stop orders, alongside automatic delta-hedging via Chainlink Automation.

Sharwa's unique approach emphasizes low-risk strategies with innovative features like American-style options and no leg risks in options strategies, where incomplete orders are automatically canceled. Traders can access a wide variety of options strategies, from simple calls and puts to more complex structures like covered strangles and iron butterflies. The platform is designed to offer deep liquidity, especially for large options trades, through partnerships with protocols like Hegic, Premia, and Uniswap. Additionally, liquidity providers can earn high APYs by supplying assets like USDC, ETH, and WBTC to Sharwa’s pools, with proper collateralization and Chainlink Automation ensuring safe liquidation.

The platform has received positive feedback from users, particularly for its innovative design and the ability to manage complex positions across DeFi options protocols. Sharwa.Finance has continuously expanded its features, from launching its first version in late 2022 to offering multi-collateral margin accounts and leveraging deep liquidity for both spot and options trading by 2024. Its roadmap includes further developments like the Option-Chain and advanced margin accounts. Sharwa aims to simplify high-leverage trading while offering unique tools and strategies, positioning itself as a leading solution in the decentralized finance (DeFi) space.

SharwaFinance underwent a thorough audit by Pashov Audit Group over a year ago, where vulnerabilities were identified and patched by a team of four security researchers. However, after the audit, the Sharwa team made changes to the code that were not re-reviewed due to the high cost of security reviews, leaving room for vulnerabilities.

The attacker exploited a vulnerability in the MarginTrading contract by first creating a margin account and borrowing assets through leveraged lending using the provided collateral. They then executed a sandwich attack, targeting the swap operation that involved the borrowed assets. This attack leveraged the absence of an insolvency check during the swap process, allowing the attacker to manipulate the transaction.

The root cause of the issue lies in the design flaw within the swap() function of the MarginTrading contract, which exchanges one token (e.g., WBTC) for another (e.g., USDC). The function only checks the account's solvency before executing the swap, not accounting for potential changes in the account’s status during the transaction itself. This oversight left the contract vulnerable to manipulation, enabling the attacker to exploit the system for their gain.

Losses were reported by SlowMist as $146,000.

Following the exploit of SharwaFinance, the $USDC and $WBTC liquidity pools were impacted, prompting the platform to temporarily pause trading. In response to the attack, SharwaFinance committed to fully reimbursing all users who lost funds during the incident, ensuring a 100% refund for those affected.

The incident at SharwaFinance resulted in a temporary halt of the platform, as vulnerabilities in the system were exploited, impacting liquidity pools like $USDC and $WBTC. In response, Sharwa paused trading and committed to fully refunding affected users, ensuring that all funds lost during the exploit would be restored. The platform also entered Reduce-Only mode, allowing users to close positions and withdraw collateral while preventing new positions from being opened. Loss compensation for users was scheduled to be sent by October 27, marking a clear effort by the team to address the fallout from the hack.

Despite the setback, SharwaFinance remains optimistic about its recovery. The platform had previously undergone a strong audit by Pashov Audit Group, but some post-audit changes were not reviewed, leading to the vulnerabilities. The team acknowledged the challenge of affording ongoing, high-quality security reviews but expressed confidence that Sharwa could recover, highlighting the support from the community and the lessons learned. The project emphasized the importance of continuous security checks and pledged to implement fixes and improvements before fully reopening the platform.

Sharwa Finance has assured users that all losses will be fully reimbursed.

Despite this setback, the Sharwa team is optimistic about recovery, noting that many projects have bounced back from similar incidents. They stress the importance of continuous security reviews, urging teams to have experts review every change, regardless of budget, and offering support for those in need.

Sharwa.Finance, a decentralized crypto prime brokerage platform launched in 2022, suffered a security exploit due to a vulnerability in its MarginTrading contract. The attacker leveraged a flaw in the swap function, which failed to account for changes in account solvency during transactions, allowing for manipulation. The exploit resulted in a loss of $146,000, primarily affecting the $USDC and $WBTC liquidity pools. In response, Sharwa paused trading, entered Reduce-Only mode, and committed to reimbursing all affected users. Despite the setback, the team remains optimistic, acknowledging the need for continuous security audits and promising to implement necessary improvements before the platform fully reopens.

phalcon_xyz - ". @SharwaFinance was reported to be exploited and subsequently paused (as claimed by the project). However, several additional suspicious transactions occurred hours later, likely exploiting the same underlying issue through slightly varied attack paths." - Twitter/X (Oct 27)
SharwaFinance - "@SharwaFinance has been exploited. The $USDC and $WBTC liquidity pools were affected. Trading is temporarily paused. All users who lost funds during the attack will be 100% refunded." - Twitter/X (Oct 27)
Attacker Opens First Margin Account - BlockSec App (Oct 27)
Attacker Completes First Attack - BlockSec App (Oct 27)
Attacker Opens Second Margin Account - BlockSec App (Oct 27)
Attacker Completes Second Attack - BlockSec App (Oct 27)
SharwaFinance - "Update for All Traders You can now close your positions and withdraw your collateral. Sharwa is currently in Reduce-Only mode no new positions can be opened. Loss coverage for all users will be sent to your wallets by October 27 Well be back once the bugs are fixed and our security improvements are complete." - Twitter/X (Oct 27)
PashovAuditGrp - "The honest story of a project hack in web3, told by a dev with good intentions. Sharwa got an audit from Pashov Audit Group more than a year ago. It was a strong audit - 4 security researchers found many vulnerabilities and helped the team patch them. Unfortunately, Sharwa's team added changes post-audit, and since security reviews are never cheap, the changes were not reviewed, so vulnerabilities have slipped. The situation is that security costs ramp up fast, so not everybody can truly afford high-quality reviews." - Twitter/X (Oct 27)
SharwaFinance - "Well unpause the system by October 27, or earlier if everything is ready sooner. All traders will have their funds fully restored, and any losses incurred will be covered by us under the Early Sherpa whitelist program." - Twitter/X (Oct 27)
SharwaFinance - "Sharwa Attack Post-Mortem" - Twitter/X (Oct 27)
Weilin (William) Li - "It apears @SharwaFinance is hacked. The root cause appears to be a price manipulation/atomic sandwich attack. Sharwa Finance is a lending protocol where users can open a long/short position on BTC & ETH. However, it trusted Uniswap V3 quoters' price and blindly decreases a position by swapping on Uniswap V3." - Twitter/X (Oct 27)
Sharwa Finance Twitter/X Account (Oct 27)
Sharwa Finance Homepage (Oct 27)

More case studies

Typus Finance Oracle Missing
Update V2 Authorization Check

DoodiPals NFT Treasury Drained
After Private Key Leakage