88MPH Init Vulnerability - Revision history

Azoundria at 23:53, 2 May 2023

2023-05-02T23:53:27Z

← Older revision		Revision as of 17:53, 2 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/88mphinitvulnerability.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/88mphinitvulnerability.php}}
	{{Unattributed Sources}}		{{Unattributed Sources}}

Line 6:		Line 6:
	This was discovered by a white hacker before being exploited. As a result, all funds were safe and a bounty was issued.		This was discovered by a white hacker before being exploited. As a result, all funds were safe and a bounty was issued.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="iosiro-2540" /><ref name="88mph-1624" /><ref name="88mphappmedium-1625" /><ref name="defiprime-1626" /><ref name="defipulse-1627" /><ref name="immunefimedium-2541" /><ref name="etherscan-2542" /><ref name="pechshieldaudit-2543" />
	<ref name="iosiro-2540" /><ref name="88mph-1624" /><ref name="88mphappmedium-1625" /><ref name="defiprime-1626" /><ref name="defipulse-1627" /><ref name="immunefimedium-2541" /><ref name="etherscan-2542" /><ref name="pechshieldaudit-2543" />

	== About 88MPH ==		== About 88MPH ==
Line 63:		Line 62:
	!Description		!Description
	\|-		\|-
	\|June 7th, 2021 ~~12:00:00 AM~~		\|June 7th, 2021
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 71:		Line 70:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 90:		Line 92:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
	== Prevention Policies ==
	Smart contracts are a form of hot wallet, and not as secure as cold storage. The issue remained despite professional auditing, which is an important illustration of how hot wallet systems cannot be proven secure.		Smart contracts are a form of hot wallet, and not as secure as cold storage. The issue remained despite professional auditing, which is an important illustration of how hot wallet systems cannot be proven secure.

	In general, cold storage with a proper multi-signature wallet held by trained and background checked individuals is a more secure method of storage.		In general, cold storage with a proper multi-signature wallet held by trained and background checked individuals is a more secure method of storage.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	<references><ref name="iosiro-2540">[https://iosiro.com/blog/88mph-bug-bounty-post-mortem Critical Bug Identified in 88mph Awarded with $42,069 Bounty \| iosiro] (Jul 12, 2021)</ref>		<references><ref name="iosiro-2540">[https://iosiro.com/blog/88mph-bug-bounty-post-mortem Critical Bug Identified in 88mph Awarded with $42,069 Bounty \| iosiro] (Jul 13, 2021)</ref>

	<ref name="88mph-1624">[https://88mph.app/ 88mph] (Jul 12, 2021)</ref>		<ref name="88mph-1624">[https://88mph.app/ 88mph] (Jul 13, 2021)</ref>

	<ref name="88mphappmedium-1625">[https://medium.com/88mphapp/88mph-launch-%EF%B8%8F-2ad95b8bd518 88mph launch . Back to the future of DeFi — Monday… \| by McFly \| 88mph \| 88mphapp \| Medium] (Jul 12, 2021)</ref>		<ref name="88mphappmedium-1625">[https://medium.com/88mphapp/88mph-launch-%EF%B8%8F-2ad95b8bd518 88mph launch . Back to the future of DeFi — Monday… \| by McFly \| 88mph \| 88mphapp \| Medium] (Jul 13, 2021)</ref>

	<ref name="defiprime-1626">[https://defiprime.com/88mph 88mph - Fixed Interest Rate Lending Protocol] (Jul 12, 2021)</ref>		<ref name="defiprime-1626">[https://defiprime.com/88mph 88mph - Fixed Interest Rate Lending Protocol] (Jul 13, 2021)</ref>

	<ref name="defipulse-1627">[https://defipulse.com/88mph 88mph \| Stats, Charts and Guide \| DeFi Pulse] (Jul 12, 2021)</ref>		<ref name="defipulse-1627">[https://defipulse.com/88mph 88mph \| Stats, Charts and Guide \| DeFi Pulse] (Jul 13, 2021)</ref>

	<ref name="immunefimedium-2541">[https://medium.com/immunefi/88mph-function-initialization-bug-fix-postmortem-c3a2282894d3 88mph Function Initialization Bug Fix Postmortem] (Aug 14, 2021)</ref>		<ref name="immunefimedium-2541">[https://medium.com/immunefi/88mph-function-initialization-bug-fix-postmortem-c3a2282894d3 88mph Function Initialization Bug Fix Postmortem] (Aug 15, 2021)</ref>

	<ref name="etherscan-2542">[https://etherscan.io/txs?a=0x7fdef304e2d4b464a745042f8db5abad277d3f11 Ethereum Transactions Information \| Etherscan] (Aug 14, 2021)</ref>		<ref name="etherscan-2542">[https://etherscan.io/txs?a=0x7fdef304e2d4b464a745042f8db5abad277d3f11 Ethereum Transactions Information \| Etherscan] (Aug 15, 2021)</ref>

	<ref name="pechshieldaudit-2543">[https://files.safe.defiyield.app/safe/files/audit/pdf/peckshield_audit_report_88mph_v1_0_1.pdf Peckshield Smart Contract Audit Report - 88MPH] (Aug 14, 2021)</ref></references>		<ref name="pechshieldaudit-2543">[https://files.safe.defiyield.app/safe/files/audit/pdf/peckshield_audit_report_88mph_v1_0_1.pdf Peckshield Smart Contract Audit Report - 88MPH] (Aug 15, 2021)</ref></references>

Azoundria at 17:33, 22 February 2023

2023-02-22T17:33:51Z

← Older revision		Revision as of 11:33, 22 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/88mphinitvulnerability.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/88mphinitvulnerability.php}}
			{{Unattributed Sources}}

	[[File:88mph.jpg\|thumb\|88MPH]]The audited 88MPH smart contract hot wallet was storing $6.5m in funds. There was an error in the smart contract which allowed anyone to initialize the contract, thereby granting themselves the mint and burn functionality.		[[File:88mph.jpg\|thumb\|88MPH]]The audited 88MPH smart contract hot wallet was storing $6.5m in funds. There was an error in the smart contract which allowed anyone to initialize the contract, thereby granting themselves the mint and burn functionality.
Line 6:		Line 7:

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="iosiro-2540" /><ref name="88mph-1624" /><ref name="88mphappmedium-1625" /><ref name="defiprime-1626" /><ref name="defipulse-1627" /><ref name="immunefimedium-2541" /><ref name="etherscan-2542" /><ref name="pechshieldaudit-2543" />

	== About 88MPH ==		== About 88MPH ==
Line 82:		Line 84:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~The total amount~~ recovered ~~has been estimated at $0 USD~~.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 95:		Line 97:

	== References ==		== References ==
	[https://iosiro.com/blog/88mph-bug-bounty-post-mortem Critical Bug Identified in 88mph Awarded with $42,069 Bounty \| iosiro] (Jul 12)		<references><ref name="iosiro-2540">[https://iosiro.com/blog/88mph-bug-bounty-post-mortem Critical Bug Identified in 88mph Awarded with $42,069 Bounty \| iosiro] (Jul 12, 2021)</ref>

	[https://88mph.app/ 88mph] (Jul 12)		<ref name="88mph-1624">[https://88mph.app/ 88mph] (Jul 12, 2021)</ref>

	[https://medium.com/88mphapp/88mph-launch-%EF%B8%8F-2ad95b8bd518 88mph launch ~~��⚡️~~. Back to the future of DeFi — Monday… \| by McFly �\| 88mph \| 88mphapp \| Medium] (Jul 12)		<ref name="88mphappmedium-1625">[https://medium.com/88mphapp/88mph-launch-%EF%B8%8F-2ad95b8bd518 88mph launch . Back to the future of DeFi — Monday… \| by McFly \| 88mph \| 88mphapp \| Medium] (Jul 12, 2021)</ref>

	[https://defiprime.com/88mph 88mph - Fixed Interest Rate Lending Protocol] (Jul 12)		<ref name="defiprime-1626">[https://defiprime.com/88mph 88mph - Fixed Interest Rate Lending Protocol] (Jul 12, 2021)</ref>

	[https://defipulse.com/88mph 88mph \| Stats, Charts and Guide \| DeFi Pulse] (Jul 12)		<ref name="defipulse-1627">[https://defipulse.com/88mph 88mph \| Stats, Charts and Guide \| DeFi Pulse] (Jul 12, 2021)</ref>

	[https://medium.com/immunefi/88mph-function-initialization-bug-fix-postmortem-c3a2282894d3 88mph Function Initialization Bug Fix Postmortem] (Aug 14)		<ref name="immunefimedium-2541">[https://medium.com/immunefi/88mph-function-initialization-bug-fix-postmortem-c3a2282894d3 88mph Function Initialization Bug Fix Postmortem] (Aug 14, 2021)</ref>

	[https://etherscan.io/txs?a=0x7fdef304e2d4b464a745042f8db5abad277d3f11 Ethereum Transactions Information \| Etherscan] (Aug 14)		<ref name="etherscan-2542">[https://etherscan.io/txs?a=0x7fdef304e2d4b464a745042f8db5abad277d3f11 Ethereum Transactions Information \| Etherscan] (Aug 14, 2021)</ref>

	[https://files.safe.defiyield.app/safe/files/audit/pdf/peckshield_audit_report_88mph_v1_0_1.pdf Peckshield Smart Contract Audit Report - 88MPH] (Aug 14)		<ref name="pechshieldaudit-2543">[https://files.safe.defiyield.app/safe/files/audit/pdf/peckshield_audit_report_88mph_v1_0_1.pdf Peckshield Smart Contract Audit Report - 88MPH] (Aug 14, 2021)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/88mphinitvulnerability.php}} 88MPHThe audited 88MPH smart contract hot wallet was storing $6.5m in funds. There was an error in the smart contract which allowed anyone to initialize the contract, thereby granting themselves the mint and burn functionality. This was discovered by a white hacker before being exploited. As a result, all funds were safe and a bounty was issue..."

2023-01-27T18:27:11Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/88mphinitvulnerability.php}} thumb|88MPHThe audited 88MPH smart contract hot wallet was storing $6.5m in funds. There was an error in the smart contract which allowed anyone to initialize the contract, thereby granting themselves the mint and burn functionality. This was discovered by a white hacker before being exploited. As a result, all funds were safe and a bounty was issue..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/88mphinitvulnerability.php}}

[[File:88mph.jpg|thumb|88MPH]]The audited 88MPH smart contract hot wallet was storing $6.5m in funds. There was an error in the smart contract which allowed anyone to initialize the contract, thereby granting themselves the mint and burn functionality.

This was discovered by a white hacker before being exploited. As a result, all funds were safe and a bounty was issued.

This is a global/international case not involving a specific country.

== About 88MPH ==
"88mph is a fixed-rate yield-generation protocol." "88mph is a fixed-rate yield-generation protocol on Ethereum that allows users to deposit assets, earn fixed-rate interests, and farm for MPH tokens." You can "lend your crypto assets at a fixed interest rate or buy some floating-rate bonds. By doing so, you earn upfront $MPH token and system rewards." "Earn fixed-rate interest on your crypto and MPH rewards." "[L]end your crypto assets at a fixed interest rate with infinite liquidity." "The first mainnet version was launched in April 2020." The team "started working on a new version of the protocol in June and did [their] first security audit at that time, with the help of an Aave grant."

"88mph protocol is controlled by the MPH community who have the power to shape the future of the protocol. the governance treasury receives the MPH tokens paid back by depositors when they withdraw their deposits. The MPH community can propose and vote on various proposals ranging from protocol parameter changes to smart ways of using the capital assets stored in the treasury for creating new incentives, capitalization, and at the end growth."

88MPH had been audited by PeckShield on January 11th, 2020.

"On 7 June 2021, Ashiq Amien, a security researcher at iosiro, identified a critical bug in the fixed-interest-rate lending protocol 88mph." "The initialization bug was identified in 88mph's NFT contract, and resulted in allowing anyone to claim ownership of the contract and steal the underlying assets."

"The vulnerability was an unprotected init() function in the code of these specific pools that would have allowed a malicious user to steal $6.5m in tokens, mostly in crvRenWBTC." "The vulnerability affected three pools: yaLINK, CRV:STETH, [and] CRV:RENWBTC." "At the time of the disclosure, an attacker would have been able to steal over $6.5 million USD of user assets from the protocol."

"The init() function, which is used to initialize the NFT contract on 88mph’s platform, was missing an onlyOwner modifier, and there was also no initializer modifier to prevent a re-initialization. In other words, the init() function was unprotected and was callable multiple times — and by anyone. The result of this unprotected function was that anyone could have taken ownership of the NFT contract, and ownership came with the privilege of minting pool deposit NFTs and burning any user’s NFT deposit using the mint() and burn() functions. This vulnerability would have allowed a malicious attacker to have access to any user’s NFTs and deposits."

"The bug was reported to 88mph through Immunefi." "The 88mph team responded quickly after receiving the disclosure, restricting access to the vulnerable functionality within 2 hours and extracting the funds to the treasury within 24 hours." "88mph quickly paused the affected contracts, whitehacked all user funds, and returned those funds to their rightful owners after they had been saved."

"During the assessment phase, Duncan Townsend, CTO of Immunefi, reviewed the code and suggested that 88mph pause the contracts by 1) deploying a dummy minter contract that reverted on every call, and 2) setting the minter to that contract. This pause method prevented frontrunning the whitehack and bought enough time to carefully capture all the funds and transfer them to the 88mph multisig wallet. The whitehack was executed on June 8th at 9:46pm UTC."

"The bug was reported to 88mph through Immunefi for a bounty of $42,069." "In recognition of the vulnerability’s potentially devastating impact, 88mph is awarding iosiro a bounty of $42,069 at the request of the whitehat."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - 88MPH Init Vulnerability
!Date
!Event
!Description
|-
|June 7th, 2021 12:00:00 AM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost has been estimated at $6,500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
The total amount recovered has been estimated at $0 USD.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Smart contracts are a form of hot wallet, and not as secure as cold storage. The issue remained despite professional auditing, which is an important illustration of how hot wallet systems cannot be proven secure.

In general, cold storage with a proper multi-signature wallet held by trained and background checked individuals is a more secure method of storage.

== References ==
[https://iosiro.com/blog/88mph-bug-bounty-post-mortem Critical Bug Identified in 88mph Awarded with $42,069 Bounty | iosiro] (Jul 12)

[https://88mph.app/ 88mph] (Jul 12)

[https://medium.com/88mphapp/88mph-launch-%EF%B8%8F-2ad95b8bd518 88mph launch ��⚡️. Back to the future of DeFi — Monday… | by McFly �| 88mph | 88mphapp | Medium] (Jul 12)

[https://defiprime.com/88mph 88mph - Fixed Interest Rate Lending Protocol] (Jul 12)

[https://defipulse.com/88mph 88mph | Stats, Charts and Guide | DeFi Pulse] (Jul 12)

[https://medium.com/immunefi/88mph-function-initialization-bug-fix-postmortem-c3a2282894d3 88mph Function Initialization Bug Fix Postmortem] (Aug 14)

[https://etherscan.io/txs?a=0x7fdef304e2d4b464a745042f8db5abad277d3f11 Ethereum Transactions Information | Etherscan] (Aug 14)

[https://files.safe.defiyield.app/safe/files/audit/pdf/peckshield_audit_report_88mph_v1_0_1.pdf Peckshield Smart Contract Audit Report - 88MPH] (Aug 14)