THORCHAIN

DESCRIPTION OF EVENTS

"THORChain (RUNE) [is] a decentralized cross-chain transaction protocol." "Creating a secure cross-chain bridge is one of the most important milestones for the industry right now, and the race is on to be the first to provide it." "Founded in 2018, THORChain is a cross-chain exchange that facilitates transactions between the Binance, Ethereum, and Bitcoin blockchains, aiding in a difficult problem of inter-blockchain swaps without being compelled to pay sizable fees each time. This represents a tremendous pain point and the efforts of THORChain have been well-received, pushing up a token from a low of $0.00851264, two years ago, to a high of $20.89 two months ago." "THORChain entered into its guarded “Chaosnet” launch during April, facilitating cross-chain swaps across the Bitcoin, Ethereum, Litecoin, Bitcoin Cash and Binance Chain networks."

"THORChain do[es]n't have assets synthetically tied to a price using an oracle. [They] rather arbitrage trading bots and individuals, seeking to squeeze a profit from the price differences of an individual cryptocurrency on different blockchains, keep the liquidity pool's volume high in the midst of regularly large price swings. Passive liquidity providers earn a steady stream of rewards, often representing an APR of 10%+, even after technical considerations like "impermenant loss" that chips away at total return if the tokens, when removed from the liquidity pool, that aren't at 100% at the same radio value as when you first staked them."

"Bifrost [is] a DeFi protocol that connects with Polkadot and different proof-of-stake blockchains." "The Bifröst Protocol enables multichain connectivity by building a bridge between blockchains. Cross-chain bridges address one of the decentralized community’s most vexing problems: interoperability. Inspired by Norse lore, Bifröst was the name given by the Vikings to the mythic, incandescent rainbow bridge that connected Midgard (Earth) to Asgard (the Heavens). Thus, it is the protocol’s ability to mesh disparate decentralized realms into one liquid, rapid and cohesive asset exchange network that differentiates THORChain from other trustless exchange applications."

"Merging multi-signature (multi-sig) account security, proof-of-stake (PoS) cryptoeconomic schemas and continuous liquidity pools (CLPs), Bifröst is an interoperable cross-chain bridge enabling compatibility with nearly all major unspent transaction outputs (UXTOs) and account-based assets, including code-forks and tokens. Put more simply, Bifröst is the glue that holds the entire THORChain ecosystem together, enabling the seamless trading of any digital asset across any distributed ledger."

"THORChain tweeted that a malicious attack against THORChain was discovered. THORChain nodes have responded and isolated defenses. The capital loss caused by this attack was US$140,000, but THORChain stated that user funds will not be affected. The fund pool will be used to make up for the leaked funds. The team stated that the path of the attack was that EthBifrost had a logical error in processing the same symbol as ETH. THORChain claimed that it repaired Bifrost within 30 minutes and adopted node defense to stop Bifrost and THORNode. The team said it will also invest funds for ongoing code reviews and monitoring."

"On June 28, 2021 ThorChain vulnerability in ETH Bitfrost was exploited which resulted in the theft of $140K worth of assets." "A small logic bug in the Ethereum Bifröst caused a carefully-crafted ERC-20 to be mis-interpreted as ETH.ETH and swapped into the network." "Total funds stolen: - 9352,4874282 PERP - 1.43974743 YFI - 2437.936 SUSHI - 10.615 ETH Total value: ~$139k" "Thorchain told CoinDesk a hacker deployed a custom contract that was able to trick its Bifrost Protocol into receiving a deposit of fake assets."

"0 mins : Unusual transaction reported from users 5 mins : DEVs acknowledge it and let node operators know 20 mins : Nodes stop the network, super majority needed. 2h : Software fix 4h : Super majority of nodes updated / fixed 6h : Resume swaps"

ThorChain "stated that ETH Bifrost was recently updated to allow the router to be “wrapped” by contracts to allow composability." "The fix is to initialise the assets with common.EmptyAsset and return before handling ERC20s. This was merged."

"The other issue that had to be dealt with was there were several pending attack transactions that had not yet been observed by THORChain, since the attacker continued their transactions after the network was halted. If the network was brought back online prior to processing the update, these transactions would have been processed, which would have been silly and a waste of funds. Logic was added to ignore these specific transactions, coming from specific addresses."

ThorChain plans to "Restore solvency to the vaults (funded by the Treasury), Refund Node Operator Bonds that were slashed when the network was brought partially back online and didn’t have full consensus, and Pay the Bug Bounty to the reporting user." "The community are looking for 30 days of no major bugs before mainnet. This classifies as a major bug, so the clocks are reset."

"There is a scheduled TrailOfBits audit in 2 weeks, which will do a full code-review. THORChain team will continue finding and scheduling audits, especially since the code is being upgraded to service THORFi, which adds to the complexity theatre."

Explore This Case Further On Our Wiki

ThorChain is a protocol to allow trading between different blockchains. Their smart contract hot wallet was tricked into accepting a token that wasn't ETH as ETH. The attacker then withdrew the ETH.

ThorChain plans to reimburse all affected users from their own funds.

HOW COULD THIS HAVE BEEN PREVENTED?

The primary issue with ThorChain is having almost all balances of tokens in a hot wallet. While all measures employed will reduce the possibility of future failures, there is no way to prove with certainty that a hot wallet or smart contract is completely secure.

A more secure model would place the majority of funds in a multi-sig requiring the signatures of multiple known node operators, who know how to properly secure the keys offline. Funds could be released as needed for immediate liquidity, with a smaller balance at risk in the insured smart contract hot wallet.

Check Our Framework For Safe Secure Exchange Platforms

SlowMist Hacked - SlowMist Zone (May 18)
No Title (Jul 24)
Eth Parsing Error And Exploit (Jul 24)
THORSwap ⚡ #BetterThanCEX on Twitter (Aug 16)
Ethereum Transaction Hash (Txhash) Details | Etherscan (Aug 27)
Ethereum Transaction Hash (Txhash) Details | Etherscan (Aug 27)
Ethereum Transaction Hash (Txhash) Details | Etherscan (Aug 27)
Ethereum Transaction Hash (Txhash) Details | Etherscan (Aug 27)
Ethereum Transaction Hash (Txhash) Details | Etherscan (Aug 27)
Ethereum Transaction Hash (Txhash) Details | Etherscan (Aug 27)
Blockchain Protocol Thorchain Suffers $8M Hack (Aug 27)
THORChain Exploited for $5 Million in Latest DeFi Attack - BeInCrypto (Aug 27)
Rekt - THORChain - REKT (Jul 30)
THORChain Suffers a $7.8 million Dollar Attack. How a $1.4 billion Blockchain Behemoth Steadies the Ship. (Aug 16)
Thorchain Trolled by Hacker After Two Successful Seven-Figure Exploits – News Bitcoin News (Aug 16)
Dive Into DeFi: THORChain's Road to Asgardex (Aug 16)
$8M Lost as THORChain Suffers Third Attack in a Month | Crypto Briefing (Aug 27)
The Bifröst Protocol: Bridging Chains Safely | by THORChain | THORChain | Medium (Aug 27)
First attack on THORChain. Fixed already implemented. $140k funds lost (covered by treasury) : THORChain (Aug 27)
https://www.blockthreat.io/p/blockthreat-week-26-2021 (Feb 8)

More case studies

SafeDollar Reward
Logic Exploited

Haven Protocol
Triple Attack