Atomic Loans Close Call - Revision history

Azoundria at 19:34, 1 May 2023

2023-05-01T19:34:21Z

← Older revision		Revision as of 13:34, 1 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/atomicloansclosecall.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/atomicloansclosecall.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Atomicloans.jpg\|thumb\|Atomic Loans]]Atomic Loans created a service where, rather than provide your funds to a central custodian, they could instead be provided to a hot wallet smart contract. Rather than trusting a human being, you would trust arbitrary open source code.		[[File:Atomicloans.jpg\|thumb\|Atomic Loans]]Atomic Loans created a service where, rather than provide your funds to a central custodian, they could instead be provided to a hot wallet smart contract. Rather than trusting a human being, you would trust arbitrary open source code.
Line 6:		Line 6:
	Despite two separate security audits, the code still had vulnerabilities. Luckily, those vulnerabilities were found by a security researcher instead of being exploited by a hacker.		Despite two separate security audits, the code still had vulnerabilities. Luckily, those vulnerabilities were found by a security researcher instead of being exploited by a hacker.

	This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.		This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.<ref name="slowmisthacked-678" /><ref name="atomicloansarchive-1852" /><ref name="atomicloansgithub-1853" /><ref name="consensysgithub-1854" /><ref name="consensys-1855" /><ref name="quantstamp-1856" /><ref name="atomicloans-1857" /><ref name="atomicloans-1858" /><ref name="crunchbase-1859" />
	<ref name="slowmisthacked-678" /><ref name="atomicloansarchive-1852" /><ref name="atomicloansgithub-1853" /><ref name="consensysgithub-1854" /><ref name="consensys-1855" /><ref name="quantstamp-1856" /><ref name="atomicloans-1857" /><ref name="atomicloans-1858" /><ref name="crunchbase-1859" />

	== About Atomic Loans ==		== About Atomic Loans ==
Line 77:		Line 76:
	!Description		!Description
	\|-		\|-
	\|June 24th, 2020 ~~12:00:00 AM~~		\|June 24th, 2020
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 85:		Line 84:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 104:		Line 106:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
	== Prevention Policies ==
	While it's a valid concern to avoid placing funds in the control of a single human being, historically, there hasn't been a documented exit scam involving a known group of people and funds which were fully backed.		While it's a valid concern to avoid placing funds in the control of a single human being, historically, there hasn't been a documented exit scam involving a known group of people and funds which were fully backed.

	An alternative and greater form of security would include a multi-sig with at least one trusted human component.		An alternative and greater form of security would include a multi-sig with at least one trusted human component.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	<references><ref name="slowmisthacked-678">[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17, 2021)</ref>		<references><ref name="slowmisthacked-678">[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 18, 2021)</ref>

	<ref name="atomicloansarchive-1852">[https://web.archive.org/web/20200502174019/https://atomic.loans/ Non-Custodial Bitcoin-backed loans \| Atomic Loans] (Jul 25, 2021)</ref>		<ref name="atomicloansarchive-1852">[https://web.archive.org/web/20200502174019/https://atomic.loans/ Non-Custodial Bitcoin-backed loans \| Atomic Loans] (Jul 26, 2021)</ref>

	<ref name="atomicloansgithub-1853">[https://github.com/AtomicLoans/atomicloans-rfc/wiki/Security Security · AtomicLoans/atomicloans-rfc Wiki · GitHub] (Jul 25, 2021)</ref>		<ref name="atomicloansgithub-1853">[https://github.com/AtomicLoans/atomicloans-rfc/wiki/Security Security · AtomicLoans/atomicloans-rfc Wiki · GitHub] (Jul 26, 2021)</ref>

	<ref name="consensysgithub-1854">[https://github.com/ConsenSys/atomic-loans-audit-report-2019-07 GitHub - ConsenSys/atomic-loans-audit-report-2019-07: Atomic Loans audit report] (Jul 25, 2021)</ref>		<ref name="consensysgithub-1854">[https://github.com/ConsenSys/atomic-loans-audit-report-2019-07 GitHub - ConsenSys/atomic-loans-audit-report-2019-07: Atomic Loans audit report] (Jul 26, 2021)</ref>

	<ref name="consensys-1855">[https://consensys.net/diligence/audits/2019/09/atomic-loans/ Atomic Loans \| ConsenSys Diligence] (Jul 25, 2021)</ref>		<ref name="consensys-1855">[https://consensys.net/diligence/audits/2019/09/atomic-loans/ Atomic Loans \| ConsenSys Diligence] (Jul 26, 2021)</ref>

	<ref name="quantstamp-1856">[https://quantstamp.com/blog/btc-on-defi Bringing Bitcoin to DeFi] (Jul 25, 2021)</ref>		<ref name="quantstamp-1856">[https://quantstamp.com/blog/btc-on-defi Bringing Bitcoin to DeFi] (Jul 26, 2021)</ref>

	<ref name="atomicloans-1857">[https://atomic.loans/app/terms_of_service.html Atomic Loans Terms of Service] (Jul 25, 2021)</ref>		<ref name="atomicloans-1857">[https://atomic.loans/app/terms_of_service.html Atomic Loans Terms of Service] (Jul 26, 2021)</ref>

	<ref name="atomicloans-1858">[https://atomic.loans/blog/vulnerability-disclosure-and-pause-new-loan-requests/ Vulnerability Disclosure and Decision to Pause New Loan Requests] (Jul 25, 2021)</ref>		<ref name="atomicloans-1858">[https://atomic.loans/blog/vulnerability-disclosure-and-pause-new-loan-requests/ Vulnerability Disclosure and Decision to Pause New Loan Requests] (Jul 26, 2021)</ref>

	<ref name="crunchbase-1859">[https://www.crunchbase.com/organization/atomic-loans Atomic Loans - Crunchbase Company Profile & Funding] (Jul 25, 2021)</ref></references>		<ref name="crunchbase-1859">[https://www.crunchbase.com/organization/atomic-loans Atomic Loans - Crunchbase Company Profile & Funding] (Jul 26, 2021)</ref></references>

Azoundria at 17:18, 17 February 2023

2023-02-17T17:18:18Z

← Older revision		Revision as of 11:18, 17 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/atomicloansclosecall.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/atomicloansclosecall.php}}
			{{Unattributed Citations}}

	[[File:Atomicloans.jpg\|thumb\|Atomic Loans]]Atomic Loans created a service where, rather than provide your funds to a central custodian, they could instead be provided to a hot wallet smart contract. Rather than trusting a human being, you would trust arbitrary open source code.		[[File:Atomicloans.jpg\|thumb\|Atomic Loans]]Atomic Loans created a service where, rather than provide your funds to a central custodian, they could instead be provided to a hot wallet smart contract. Rather than trusting a human being, you would trust arbitrary open source code.
Line 6:		Line 7:

	This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.		This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.
			<ref name="slowmisthacked-678" /><ref name="atomicloansarchive-1852" /><ref name="atomicloansgithub-1853" /><ref name="consensysgithub-1854" /><ref name="consensys-1855" /><ref name="quantstamp-1856" /><ref name="atomicloans-1857" /><ref name="atomicloans-1858" /><ref name="crunchbase-1859" />

	== About Atomic Loans ==		== About Atomic Loans ==
Line 55:		Line 57:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 77:		Line 78:
	\|-		\|-
	\|June 24th, 2020 12:00:00 AM		\|June 24th, 2020 12:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 90:		Line 87:

	== Total Amount Lost ==		== Total Amount Lost ==
	~~The total amount~~ lost ~~is unknown~~.		No funds were lost.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 101:		Line 98:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 114:		Line 111:

	== References ==		== References ==
	[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17)		<references><ref name="slowmisthacked-678">[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17, 2021)</ref>

	[https://web.archive.org/web/20200502174019/https://atomic.loans/ Non-Custodial Bitcoin-backed loans \| Atomic Loans] (Jul 25)		<ref name="atomicloansarchive-1852">[https://web.archive.org/web/20200502174019/https://atomic.loans/ Non-Custodial Bitcoin-backed loans \| Atomic Loans] (Jul 25, 2021)</ref>

	[https://github.com/AtomicLoans/atomicloans-rfc/wiki/Security Security · AtomicLoans/atomicloans-rfc Wiki · GitHub] (Jul 25)		<ref name="atomicloansgithub-1853">[https://github.com/AtomicLoans/atomicloans-rfc/wiki/Security Security · AtomicLoans/atomicloans-rfc Wiki · GitHub] (Jul 25, 2021)</ref>

	[https://github.com/ConsenSys/atomic-loans-audit-report-2019-07 GitHub - ConsenSys/atomic-loans-audit-report-2019-07: Atomic Loans audit report] (Jul 25)		<ref name="consensysgithub-1854">[https://github.com/ConsenSys/atomic-loans-audit-report-2019-07 GitHub - ConsenSys/atomic-loans-audit-report-2019-07: Atomic Loans audit report] (Jul 25, 2021)</ref>

	[https://consensys.net/diligence/audits/2019/09/atomic-loans/ Atomic Loans \| ConsenSys Diligence] (Jul 25)		<ref name="consensys-1855">[https://consensys.net/diligence/audits/2019/09/atomic-loans/ Atomic Loans \| ConsenSys Diligence] (Jul 25, 2021)</ref>

	[https://quantstamp.com/blog/btc-on-defi Bringing Bitcoin to DeFi] (Jul 25)		<ref name="quantstamp-1856">[https://quantstamp.com/blog/btc-on-defi Bringing Bitcoin to DeFi] (Jul 25, 2021)</ref>

	[https://atomic.loans/app/terms_of_service.html Atomic Loans Terms of Service] (Jul 25)		<ref name="atomicloans-1857">[https://atomic.loans/app/terms_of_service.html Atomic Loans Terms of Service] (Jul 25, 2021)</ref>

	[https://atomic.loans/blog/vulnerability-disclosure-and-pause-new-loan-requests/ Vulnerability Disclosure and Decision to Pause New Loan Requests] (Jul 25)		<ref name="atomicloans-1858">[https://atomic.loans/blog/vulnerability-disclosure-and-pause-new-loan-requests/ Vulnerability Disclosure and Decision to Pause New Loan Requests] (Jul 25, 2021)</ref>

	[https://www.crunchbase.com/organization/atomic-loans Atomic Loans - Crunchbase Company Profile & Funding] (Jul 25)		<ref name="crunchbase-1859">[https://www.crunchbase.com/organization/atomic-loans Atomic Loans - Crunchbase Company Profile & Funding] (Jul 25, 2021)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/atomicloansclosecall.php}} Atomic LoansAtomic Loans created a service where, rather than provide your funds to a central custodian, they could instead be provided to a hot wallet smart contract. Rather than trusting a human being, you would trust arbitrary open source code. Despite two separate security audits, the code still had vulnerabilities. Luckily, those vuln..."

2023-01-25T17:31:14Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/atomicloansclosecall.php}} thumb|Atomic LoansAtomic Loans created a service where, rather than provide your funds to a central custodian, they could instead be provided to a hot wallet smart contract. Rather than trusting a human being, you would trust arbitrary open source code. Despite two separate security audits, the code still had vulnerabilities. Luckily, those vuln..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/atomicloansclosecall.php}}

[[File:Atomicloans.jpg|thumb|Atomic Loans]]Atomic Loans created a service where, rather than provide your funds to a central custodian, they could instead be provided to a hot wallet smart contract. Rather than trusting a human being, you would trust arbitrary open source code.

Despite two separate security audits, the code still had vulnerabilities. Luckily, those vulnerabilities were found by a security researcher instead of being exploited by a hacker.

This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.

== About Atomic Loans ==
"Toronto-based" "Atomic Loans aims to bring decentralized finance to the bitcoin market." "Non-custodial Bitcoin-backed loans.
Giving custody is not okay. Do it the Bitcoin way." "Access liquidity to pay bills and expenses for yourself and your business." "We understand how it feels to send your Bitcoin to some custodian and hope for the best. With AtomicLoans, your Bitcoin is locked via native Bitcoin scripts." "There’s no application needed to start using Bitcoin, no business hours that Bitcoin adheres to." "Get access to a Bitcoin-backed loan at any time, from anywhere, in a matter of minutes." "Atomic Loans’ decentralized platform allows borrowers and lenders to engage in peer-to-peer bitcoin-backed loans, without the need for centralized custodians."

“Bitcoin is a currency where much of its value is derived from being open, transparent, borderless, and censorship-resistant. It runs 24/7 and you never need someone’s permission to use it,” said Tony Cai, co-founder and CEO of Atomic Loans. “We want to help build a future where financial tools for bitcoin can share every single one of those characteristics as well.”

"Security is the highest priority of the Atomic Loans team." "The protocol’s contract code and balances are publicly verifiable." "Our Bitcoin scripts and Ethereum smart contracts have been reviewed and audited by Quantstamp and ConsenSys Diligence."

"The [first ConsenSys Diligence] audit team evaluated that the system is secure, resilient, and working according to its specifications." "ConsenSys Diligence [then] conducted a second security audit on the Atomic Loans smart contract system." "The audit team evaluated that the system is secure, resilient, and working according to its specifications." A "smart contract audit was [also] prepared by Quantstamp, the protocol for securing smart contracts." "Quantstamp has assessed the Atomic Loans
smart contracts and Bitcoin scripts, and
consider them to be well-architected and
adherent to the provided specification. No
critical security issues were detected during
this audit, however we provide several
suggestions for code improvements based on
issues found during the audit."

"The Site and the Services are provided on an “as is” and “as available” basis. Use of the Site and the Services is at your own risk. To the maximum extent permitted by applicable law, the Site and the Services is provided without warranties of any kind, whether express or implied." "You acknowledge that applications are code that are subject to flaws and acknowledge that you are solely responsible for evaluating any available code provided by the Services. You further expressly acknowledge and represent that applications can be written maliciously or negligently, that we cannot be held liable for your interaction with such applications."

"[T]he Atomic Loans v1 beta was at $255,173 in stablecoin supplied, $90,290 in stablecoin borrowed, and ~23.9 BTC locked (total value locked: $485706). We also reached a total of $202,333 in total loans originated since launch."

"On Sunday, June 21st, security researcher @samczsun privately disclosed two vulnerabilities in the currently deployed contracts and lender agents." "Both vulnerabilities would've allowed a malicious borrower to unlock part/ all of their BTC collateral without repaying their loan in specific circumstances."

"A malicious borrower could’ve unlocked their BTC collateral without repaying their loan by front-running a loan cancellation transaction from the lender after the lender secret has already been revealed in the mempool." "Lender funds could have been impacted if the vulnerability had been exploited and the lender is unable to pay a high enough gas fee to ensure the loan cancellation succeeded."

"Although we had two audits done on the smart contracts, as well as an internal audit done by the team, it showed us it is still possible for these types of issues to slip through the cracks."

"Atomic Loans, issued a decision on vulnerability disclosure and suspension of new loan requests." "On Monday, June 23rd, we pushed an update to lender agents, effectively disallowing new loan requests."

"This vulnerability could be easily fixed by adding a withdrawExpiration to the withdraw function in the Loans contract." "We have notified the issues to both our previous auditors, ConsenSys Dilligence and Quantstamp for additional feedback. We want to do our part in helping the auditing community understand how we can better identify these types of vulnerabilities in cross-chain systems moving forward."

"Up to now, neither of these vulnerabilities were exploited by any users, and there were no funds impacted on the platform. Additionally the platform has disabled the ability for any borrower or lender to participate in new loans until they launch v2." "Additionally, ahead of V2 launch, we are planning on organizing a white-hat hacker event, in addition to multiple audits and implementing a bug bounty program."

This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Atomic Loans Close Call
!Date
!Event
!Description
|-
|June 24th, 2020 12:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
While it's a valid concern to avoid placing funds in the control of a single human being, historically, there hasn't been a documented exit scam involving a known group of people and funds which were fully backed.

An alternative and greater form of security would include a multi-sig with at least one trusted human component.

== References ==
[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17)

[https://web.archive.org/web/20200502174019/https://atomic.loans/ Non-Custodial Bitcoin-backed loans | Atomic Loans] (Jul 25)

[https://github.com/AtomicLoans/atomicloans-rfc/wiki/Security Security · AtomicLoans/atomicloans-rfc Wiki · GitHub] (Jul 25)

[https://github.com/ConsenSys/atomic-loans-audit-report-2019-07 GitHub - ConsenSys/atomic-loans-audit-report-2019-07: Atomic Loans audit report] (Jul 25)

[https://consensys.net/diligence/audits/2019/09/atomic-loans/ Atomic Loans | ConsenSys Diligence] (Jul 25)

[https://quantstamp.com/blog/btc-on-defi Bringing Bitcoin to DeFi] (Jul 25)

[https://atomic.loans/app/terms_of_service.html Atomic Loans Terms of Service] (Jul 25)

[https://atomic.loans/blog/vulnerability-disclosure-and-pause-new-loan-requests/ Vulnerability Disclosure and Decision to Pause New Loan Requests] (Jul 25)

[https://www.crunchbase.com/organization/atomic-loans Atomic Loans - Crunchbase Company Profile & Funding] (Jul 25)