Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/astroportmaliciouscosmwasmreentrancyattack.php}} {{Unattributed Sources}} AstroPort Logo/HomepageAstroport is a decentralized finance (DeFi) platform built in Rust that operates across multiple blockchains, aiming to be a central hub for asset exchanges in the Cosmos ecosystem. It provides a flexible Automated Market Maker (AMM) system with various specializ..."

2024-09-24T21:05:46Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/astroportmaliciouscosmwasmreentrancyattack.php}} {{Unattributed Sources}} thumb|AstroPort Logo/HomepageAstroport is a decentralized finance (DeFi) platform built in Rust that operates across multiple blockchains, aiming to be a central hub for asset exchanges in the Cosmos ecosystem. It provides a flexible Automated Market Maker (AMM) system with various specializ..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/astroportmaliciouscosmwasmreentrancyattack.php}}
{{Unattributed Sources}}

[[File:Astroport.jpg|thumb|AstroPort Logo/Homepage]]Astroport is a decentralized finance (DeFi) platform built in Rust that operates across multiple blockchains, aiming to be a central hub for asset exchanges in the Cosmos ecosystem. It provides a flexible Automated Market Maker (AMM) system with various specialized pools, enabling decentralized, non-custodial liquidity and price discovery for any crypto asset. Recently, a vulnerability in the Inter-Blockchain Communication (IBC) protocol was exploited, leading to a major security breach. The exploit involved a reentrancy issue allowing malicious actors to execute unauthorized transactions, resulting in the minting of additional tokens, including $ASTRO, and significant financial losses. In response, the Terra blockchain has halted operations to implement emergency fixes. The price of the ASTRO token dropped sharply by up to 71%, while LUNA's price fell slightly by 3%. The total value locked on Terra also decreased by 15% following the incident.<ref name="rektnews-14770" /><ref name="rarmatwitter-14771" /><ref name="mintscan-14772" /><ref name="etherscan-14773" /><ref name="mintscan-14774" /><ref name="cosmosgithub-14775" /><ref name="tobyfrei4twitter-14776" /><ref name="astroportfitwitter-14777" /><ref name="terramoneytwitter-14778" /><ref name="mintscan-14779" /><ref name="cryptobriefing-14780" /><ref name="beosinalerttwitter-14781" /><ref name="astroportfi-14782" /><ref name="astroportfidocs-14783" /><ref name="astroportfidocs-14784" /><ref name="astroportfidocs-14785" /><ref name="astroportfidocs-14786" /><ref name="astroportfiblog-14787" />

== About AstroPort ==
"Astroport. The future of trading" "Written from scratch in Rust, Astroport combines the best pieces of six years of development on the Ethereum blockchain and delivers it on multiple blockchains with a unique hub and outpost model." "Astroport is the central space station of the DeFi solar system, where travelers throughout the galaxy meet to exchange assets in a neutral marketplace. The philosophy behind Astroport is simple:

Enabling decentralized, non-custodial liquidity and price discovery for any crypto asset.

Astroport prioritizes flexibility, combining various specialized pool types and routing seamlessly across them."

"Astroport's vision is to become the prevailing next-generation AMM with deep liquidity pools and significant trading volumes for the Cosmos ecosystem. Better pricing will allow Astroport to attract more liquidity, leading to a self-reinforcing loop."

"The essential primitive within any DeFi ecosystem is the asset exchange functionality. Automated Market Makers (AMMs) like Astroport enable swaps in a decentralized, non-custodial, way.

With Astroport, liquidity providers (LPs) can choose different pool types within a single and effective AMM system. Thus, anyone can onboard and trade tokens in a permissionless way. Moreover, no captain or bureaucrat can stop them, as the station is owned solely by its users."

== The Reality ==
"Through the deployment and subsequent use of a malicious CosmWasm contract via IBC interactions, an attacker could potentially execute the same MsgTimeout inside the IBC hook for the OnTimeout callback before the packet commitment is deleted. On chains where ibc-hooks wraps ICS-20, this vulnerability may allow for the logic of the OnTimeout callback of the transfer application to be recursively executed, leading to a condition that may present the opportunity for the loss of funds from the escrow account or unexpected minting of tokens."

== What Happened ==
"According to Beosin, the attacker exploited a reentrancy vulnerability related to the interoperability function of the Cosmos ecosystem called Inter-Blockchain Communication (IBC), which was disclosed in April this year."
{| class="wikitable"
|+Key Event Timeline - AstroPort Malicious CosmWasm Reentrancy Attack
!Date
!Event
!Description
|-
|July 30th, 2024 6:31:23 AM MDT
|Attacker Account Funded
|The attacker account is funded by an ethereum transaction.
|-
|July 30th, 2024 4:09:15 PM MDT
|Attack Transaction
|The timestamp of the attack transaction referenced by Rarma in their post on X.
|-
|July 30th, 2024 8:45:00 PM MDT
|Tweet By Rarma
|Twitter user and ASTRO holder Rarma reports that millions are going through a wallet in a suspicious manner, and they are looking into what is happening further.
|-
|July 30th, 2024 10:06:00 PM MDT
|Terra Blockchain Suspension
|Terra announces a suspension of the blockchain to "remediate a suspected exploit".
|-
|July 30th, 2024 10:17:05 PM MDT
|Terra Blockchain Suspension
|The terra blockchain is actually suspended at block 11430400.
|-
|July 30th, 2024 10:45:00 PM MDT
|Astroport Acknowledgement
|Astroport publishes a tweet acknowledging the exploit.
|-
|July 31st, 2024 1:23:00 AM MDT
|Boesin Tweet Published
|Boesin publishes a tweet which is later referenced by CryptoBriefing.
|-
|July 31st, 2024 6:32:44 AM MDT
|CryptoBriefing Article Published
|CryptoBriefing publishes an article about the exploit.
|}

== Technical Details ==
"According to Beosin, the attacker exploited a reentrancy vulnerability related to the interoperability function of the Cosmos ecosystem called Inter-Blockchain Communication (IBC), which was disclosed in April this year."

== Total Amount Lost ==
The total amount lost has been estimated at $6,400,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
"Actively looking into WHAT is happening. The wallet never receives morre than56 LUNA and 7.8k USDC and leaves with MILLIONS.

A contract is instantiated on Terra, which is then called with an IBC transfer that times out, and tokens arrive in the account, which then get IBC transferred out.

"Attention Terra users: Please be advised that the chain will be halted shortly at block height 11430400 and transactions will not be processed during this time.

We will be working with the validators on Terra (phoenix-1) to apply an emergency patch thereafter to remediate a suspected exploit."

"Terra chain has halted for emergency upgrades.

It appears an IBC vulnerability was exploited in order to mint several tokens on Terra chain, including $ASTRO. As the chain has now halted, no further tokens are able to be minted at this time.

The Astroport contributors are working with the other chains and Cosmos builders to determine what measures can be taken. We will keep you updated as we learn more."

"The price of the token ASTRO, native to the decentralized exchange Astroport, slumped up to 71% following the exploit news. Meanwhile, the price of the token LUNA remained relatively steady, falling 3% in the past 24 hours. The total value locked at Terra also took a hit after the exploit, shrinking by 15%."

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rektnews-14770">[https://rekt.news/astroport-rekt/ Rekt - Astroport - Rekt] (Accessed Aug 6, 2024)</ref>

<ref name="rarmatwitter-14771">[https://twitter.com/Rarma_/status/1818477986569765308 @Rarma_ Twitter] (Accessed Aug 6, 2024)</ref>

<ref name="mintscan-14772">[https://www.mintscan.io/terra/address/terra1wrve5z5vsmrgy6ldcveq93aldr6wk3qmxavs4j Mintscan] (Accessed Aug 6, 2024)</ref>

<ref name="etherscan-14773">[https://etherscan.io/tx/0xe37746180fe61eea0d51ea1b806ec8a671148796322240f708ad514b9a6a0f7b Ethereum Transaction Hash (Txhash) Details | Etherscan] (Accessed Aug 6, 2024)</ref>

<ref name="mintscan-14774">[https://www.mintscan.io/terra/tx/4F260BFD0D9357859A186D1EDD9CF6CEDF4EA521D1595CB7823DE22D6084DDA0?height=11426811 Mintscan] (Accessed Aug 6, 2024)</ref>

<ref name="cosmosgithub-14775">[https://github.com/cosmos/ibc-go/security/advisories/GHSA-j496-crgh-34mx ASA-2024-007: Potential Reentrancy using Timeout Callbacks in ibc-hooks · Advisory · cosmos/ibc-go · GitHub] (Accessed Aug 6, 2024)</ref>

<ref name="tobyfrei4twitter-14776">[https://twitter.com/TobyFrei4/status/1818593388297351478 @TobyFrei4 Twitter] (Accessed Aug 6, 2024)</ref>

<ref name="astroportfitwitter-14777">[https://twitter.com/astroport_fi/status/1818508192822837511 @astroport_fi Twitter] (Accessed Aug 6, 2024)</ref>

<ref name="terramoneytwitter-14778">[https://twitter.com/terra_money/status/1818498438759411964 @terra_money Twitter] (Accessed Aug 6, 2024)</ref>

<ref name="mintscan-14779">[https://www.mintscan.io/terra/block/11430400 Mintscan] (Accessed Aug 6, 2024)</ref>

<ref name="cryptobriefing-14780">[https://cryptobriefing.com/terra-blockchain-exploit-6m/ Terra hit by $6 million loss as attacker exploits vulnerability known since April] (Accessed Aug 6, 2024)</ref>

<ref name="beosinalerttwitter-14781">[https://twitter.com/BeosinAlert/status/1818548029416411279 @BeosinAlert Twitter] (Accessed Aug 6, 2024)</ref>

<ref name="astroportfi-14782">[https://astroport.fi/en Astroport. The future of trading.] (Accessed Aug 6, 2024)</ref>

<ref name="astroportfidocs-14783">[https://docs.astroport.fi/ Astroport Docs] (Accessed Aug 6, 2024)</ref>

<ref name="astroportfidocs-14784">[https://docs.astroport.fi/docs/overview/astroport-onboarding/astroport-onboarding-intro Astroport Onboarding | Astroport Docs] (Accessed Aug 6, 2024)</ref>

<ref name="astroportfidocs-14785">[https://docs.astroport.fi/docs/overview/astroport-onboarding/the-impact The Impact | Astroport Docs] (Accessed Aug 6, 2024)</ref>

<ref name="astroportfidocs-14786">[https://docs.astroport.fi/docs/overview/astroport-onboarding/the-vision The Vision | Astroport Docs] (Accessed Aug 6, 2024)</ref>

<ref name="astroportfiblog-14787">[https://blog.astroport.fi/post/launching-the-astroport-brand-into-the-creative-commons Launching the Astroport brand into the creative commons] (Accessed Aug 6, 2024)</ref></references>

AstroPort Malicious CosmWasm Reentrancy Attack - Revision history