SODA FINANCE

DESCRIPTION OF EVENTS

"SODA is the next generation of DeFi that will take Yield Farming to where it has never gone before! Strap in and get a straw — this is gonna be soooooo good!" "Ready to be impressed? SODA uses novel dual token economics(SODA and SoETH), and this means that anyone can deposit Wrapped Ethereum (WETH) along with other assets to earn SODA. In return, you can choose to borrow SoETH from the protocol and use SoETH to earn even more SODA."

"SODA is not another yield farming project. The long term goal of SODA is to provide more liquidity and valuable financial services to the Ethereum ecosystem. The current goal is to generate more collateral backed assets from SODA borrowing."

"Our SODA-ETH staking pool has a 5x multiplier & is currently paying out a astounding 4185% APY!"

"The financial blogger "Super Bitcoin" stated on Weibo that Mr. Huai (weibo username "crash X") participated in the liquidity mining project Soda, and suddenly discovered a loophole in which 20,000 ETH can be directly liquidated Drop. But he chose to tell the development team, but the development team did not pay attention. He had no choice but to liquidate an ETH, and sent a Weibo warning to inform the developers of the existence of this bug. One hour later, the parties to the Soda agreement responded by prompting the borrower to repay and the mortgager to withdraw, and at the same time indicated that they would fix the loopholes and suspend the front-end borrowing function. But as of the early morning of September 21st, more than 400 ETH in Soda's mortgage loan pool were still maliciously liquidated. In the morning of the same day, the agreement officially stated on Twitter that the vulnerability has been fixed, and the newly deployed smart contract is expected to take effect at 21:00 on September 22."

"Again, yield farming is a highly risky game. We understand that the SODA token’s price went down a lot, but everything happened was purely due to the supply and demand of the market. Don’t participate in anything that is beyond your risk tolerance."

"We thank you for your patience while we patch and deploy a fix for the bug. Looking back over the past 48 hours, we have done our best to reduce the asset loss. We tracked all the on-chain data and counted the total loss. In total, we found 17 addresses that were affected by this bug, of which 12 addresses totaling 448.339 WETH principal were liquidated by hackers. The actual loss to the victims is 134.5017 WETH which is 30% of the principal."

"We are willing to compensate the remaining 30% of original locked WETH in the form of SoETH from our SodaDev Pool. For example, if you locked 100 WETH, borrowed 70 SoETH, and lost your locked principal, we will send you 30 SoETH as compensation."

"The community is voicing their desire for a security audit and we hear you! We are preparing for a full audit to validate the code and give more trust to the community."

"We're happy to announce that the patch for the bug fix has been deployed and activated. All features are once again live!" "In Soda V2, there will be no more yield farming. However, we will provide different investment strategies though our vaults."

Soda Finance is a yield farming project run by an anonymous team. There was a loophole in the smart contract, which was ignored by the team. The loophole was exploited. The team partially compensated affected users. The project is still running.

HOW COULD THIS HAVE BEEN PREVENTED?

Having the majority of exchange funds (aka liquidity pool) in a hot wallet (aka smart contract) is never a good idea. However, in the DeFi space, this is the common practice. Having the majority of the liquidity in a cold storage multi-sig would have prevented it being lost due to the exploit.

Having the large scale project run by an anonymous team is never a good idea in case things go wrong with the enormously complex code. Luckily in this case, the team appears not to have malicious intent and had some interest in assisting affected users.

Check Our Framework For Safe Secure Exchange Platforms

SlowMist Hacked - SlowMist Zone (May 18)
Soda (Jul 26)
Soda V2 Do You Like This Proposal (Jul 26)
Soda Lovers Lets Move Forward (Jul 26)
@Soda_finance Twitter (Jul 26)
@Soda_finance Twitter (Jul 26)
@Soda_finance Twitter (Jul 26)
@Soda_finance Twitter (Jul 26)
@Soda_finance Twitter (Jul 26)
soda-contracts/WETHCalculatorFixed.sol at master · soda-finance/soda-contracts · GitHub (Jul 26)
The Soda Revolution (Jul 26)
Blockchain Hacks: 2020 | $15 billion lost, how can we mitigate hacks in 2021? | CertiK Foundation Blog (Jul 23)

More case studies

Sim Swapping
AT&T

Lightning Denial of Service
Attack Demonstration