$12 151 000 USD

MARCH 2021




"SIL.Finance (Sister in Law) [is] a second-generation DeFi smart financial management platform."


"With SIL's single-token approach, DeFi miners deposit funds in exchange for tokens. These tokens can be staked in an eligible pool and serve as one-sided liquidity. A smart contract-powered matching system ensures that each pool's liquidity balance is maintained by matching liquidity providers with other users who have the opposite asset. Liquidity providers (LP) will then earn a profit from LP transaction fees and LP stakes from mining, swaps, and reforming LPs. Other than addressing the issue of impermanent loss, SIL.Finance's automatic LP grouping also enables users to claim their profits from the smart contract at all times. Moreover, the system will automatically stake users' newly claimed profits, which can compound their interest by converting rewards into new LP assets."


"DeFi gathers reasonable financial services SIL.Finance contract has high-risk loopholes. Later, SIL.Finance issued an article saying that the incident was caused by a vulnerability in the smart contract permissions, which in turn triggered a general preemptive trading robot to submit a series of transactions for profit. After discovering that the smart contract could not be withdrawn due to high-risk loopholes, after 36 hours of efforts such as SlowMist, it has successfully recovered USD 12.15 million. SIL.Finance stated that if any user assets are damaged in this incident, the team decided to use its own funds to launch a compensation plan: all users who suffered losses will receive 2 times the compensation, which will be issued in SIL."


"The smart contract vulnerability was introduced by a piece of new code that the SIL.FINANCE dev team pushed after the SlowMist audit. The intention of the update was to reduce the gas cost during deposit and withdrawal. The original contract is named MatchPairNormal and the optimized version, which is currently deployed on Ethereum Mainnet, is named MatchPairNormalV2. While the intention of the team was to help users save on gas, and the updated contracts were reviewed by SlowMist, the SIL.FINANCE team made the mistake of not conducting a full security audit after these changes were made."


"With the swift reaction and help from security firms and world-class white hats, we were able to get in contact with the operator of the frontrunning bot, who assisted in returning all the funds back to the team’s multi-sig wallet."


"After 36 hours of hard work and tremendous efforts by various parties, the SIL.FINANCE team is happy to announce that all SIL LP funds amount to a total of $12,151,258.16( at the time of posting) have been recovered and secured in a multi-sig wallet address under the team’s control: 0xca8A05c084B18bdb0c58ca85a39eCEB30Fb5f78e. The funds on this address are the combined result of two rescue efforts."


"Thank you for bearing with us!"

The SIL Finance smart contract was exploited after a new piece of code was added, which introduced a vulnerability.


A malicious actor managed to steal some $12m from the contract through exploiting this vulnerability, however he was convinced to return the funds.


A smart contract is a from of hot wallet, which means that the funds can be considered "online". There is no way to prove that hot wallets or smart contracts are secure.


The only secure method of storage for funds is in an offline multi-signature wallet.


Check Our Framework For Safe Secure Exchange Platforms

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.