Deus Finance (DEI Stablecoin) Burn Vulnerability - Revision history

Azoundria: Another 30 minutes complete. Prevention added.

2023-05-29T19:13:13Z

Another 30 minutes complete. Prevention added.

Azoundria: Fixing hippo potato twitter

2023-05-16T17:09:17Z

Fixing hippo potato twitter

← Older revision		Revision as of 11:09, 16 May 2023
Line 68:		Line 68:
	\|May 5th, 2023 12:35:00 PM MDT		\|May 5th, 2023 12:35:00 PM MDT
	\|Hippo Potato Sounds the Alarm		\|Hippo Potato Sounds the Alarm
	\|The Twitter user Hippo Potato sounds the alarm on Twitter<ref~~>[https://twitter.com/hippo_potato/status/1654555505854152704 Hippo Potato~~ - "~~DEI/USDC LP on Chronos exploited, do not deposit." - Twitter] (May 8, 2023)<~~/~~ref~~>.		\|The Twitter user Hippo Potato sounds the alarm on Twitter<ref name="hippopotatotwitter-10932" />.
	\|-		\|-
	\|May 5th, 2023 12:47:00 PM MDT		\|May 5th, 2023 12:47:00 PM MDT
Line 233:		Line 233:
	<ref name="deusdaotwitter-10930">[https://twitter.com/DeusDao/status/1654614968740851715 DeusDao - "With the help of whitehats and partner projects, the DEUS team paused related contracts and burnt DEI to prevent further damage." - Twitter] (May 8, 2023)</ref>		<ref name="deusdaotwitter-10930">[https://twitter.com/DeusDao/status/1654614968740851715 DeusDao - "With the help of whitehats and partner projects, the DEUS team paused related contracts and burnt DEI to prevent further damage." - Twitter] (May 8, 2023)</ref>
	<ref name="deusdaotwitter-10931">[https://twitter.com/DeusDao/status/1654614970141753347 DeusDao - "We will follow up with a Post Mortem and formulate a recovery plan in the upcoming days." - Twitter] (May 8, 2023)</ref>		<ref name="deusdaotwitter-10931">[https://twitter.com/DeusDao/status/1654614970141753347 DeusDao - "We will follow up with a Post Mortem and formulate a recovery plan in the upcoming days." - Twitter] (May 8, 2023)</ref>
	<ref name="hippopotatotwitter-10932">[https://twitter.com/hippo_potato/status/1654555505854152704 ~~@hippo_potato~~ Twitter] (May 8, 2023)</ref>		<ref name="hippopotatotwitter-10932">[https://twitter.com/hippo_potato/status/1654555505854152704 Hippo Potato - "DEI/USDC LP on Chronos exploited, do not deposit." - Twitter] (May 8, 2023)</ref>
	<ref name="coingecko-9359">https://www.coingecko.com/en/coins/dei-token (Oct 26, 2022)</ref>		<ref name="coingecko-9359">https://www.coingecko.com/en/coins/dei-token (Oct 26, 2022)</ref>
	<ref name="deusfinance-9358">https://deus.finance/ (Oct 26, 2022)</ref>		<ref name="deusfinance-9358">https://deus.finance/ (Oct 26, 2022)</ref>

Azoundria: another 30 minutes, focus on prevention today

2023-05-16T17:07:17Z

another 30 minutes, focus on prevention today

Show changes

Azoundria: Another 30 minutes complete.

2023-05-09T19:37:42Z

Another 30 minutes complete.

← Older revision		Revision as of 13:37, 9 May 2023
Line 4:		Line 4:
	[[File:Deistablecoin.jpg\|thumb\|DEI Stablecoin]]		[[File:Deistablecoin.jpg\|thumb\|DEI Stablecoin]]

	This is a global/international case not involving a specific country.<ref name="rektnews-10917" /><ref name="adamb83024264twitter-10918" /><ref name="zelliciotwitter-10919" /><ref name="0xprotosectwitter-10920" /><ref name="arbiscan-10921" /><ref name="arbiscan-10922~~" /><ref name="metasleuthtwitter-10923" /><ref name="bscscan-10924" /><ref name="bscscan-10925" /><ref name="etherscan-10926" /><ref name="etherscan-10927" /><ref name="peckshieldtwitter-10928~~" />		This is a global/international case not involving a specific country.<ref name="rektnews-10917" /><ref name="adamb83024264twitter-10918" /><ref name="zelliciotwitter-10919" /><ref name="0xprotosectwitter-10920" /><ref name="arbiscan-10921" /><ref name="arbiscan-10922" />

	== About Deus Finance ==		== About Deus Finance ==
Line 75:		Line 75:
	!Event		!Event
	!Description		!Description
			\|-
			\|Apr 10th, 2023
			\|DEI Token Smart Contract Upgraded
			\|The DEI token smart contract is updated on the BSC network<ref name="peckshieldtwitter-10928" />.
	\|-		\|-
	\|May 5th, 2023 11:52:45 AM MDT		\|May 5th, 2023 11:52:45 AM MDT
Line 82:		Line 86:
	\|May 5th, 2023 11:53:35 AM MDT		\|May 5th, 2023 11:53:35 AM MDT
	\|Exploit on Binance Smart Chain		\|Exploit on Binance Smart Chain
	\|The exploit occured on the Binance smart chain.		\|The exploit occured on the Binance smart chain<ref name="bscscan-10925" />. This is reportedly by a white hacker<ref name="peckshieldtwitter-10928" />. They reportedly paid a fee of 2.14321709105314 BNB.
	\|-		\|-
	\|May 5th, 2023 12:35:00 PM MDT		\|May 5th, 2023 12:35:00 PM MDT
Line 90:		Line 94:
	\|May 5th, 2023 12:53:35 PM MDT		\|May 5th, 2023 12:53:35 PM MDT
	\|Exploit on Ethereum		\|Exploit on Ethereum
	\|The exploit ~~occured~~ on the ethereum chain.		\|The exploit occurred on the ethereum chain, which results in a transfer of 62,287.333509816711554912 DEI tokens to the exploiter<ref name="etherscan-10927" /><ref name="etherscan-10926" />.
	\|-		\|-
	\|May 5th, 2023 4:32:00 PM MDT		\|May 5th, 2023 4:32:00 PM MDT
	\|Acknowledgement By DeusDAO Team		\|Acknowledgement By DeusDAO Team
	\|The DeusDAO team acknowledges the attack on Twitter<ref name="deusdaotwitter-10929" /><ref name="deusdaotwitter-10930" /> and requests that users hold off on interacting with their smart contract for the time being<ref name="deusdaotwitter-10931" />. TBD expand and move to other sections.		\|The DeusDAO team acknowledges the attack on Twitter<ref name="deusdaotwitter-10929" /><ref name="deusdaotwitter-10930" /> and requests that users hold off on interacting with their smart contract for the time being<ref name="deusdaotwitter-10931" />. TBD expand and move to other sections.
			\|-
			\|May 5th, 2023 4:52:29 PM MDT
			\|BSC Tokens Transfered
			\|The exploited tokens are transferred to a different wallet address<ref>[https://bscscan.com/tx/0xbc8d70621770eafee88cb85793332bc5cce392e4348a2c2bcfb746255a6c4b64 Binance Smart Chain Exploit Token Transfer Transaction - BSCScan] (May 9, 2023)</ref><ref name="bscscan-10924" />. This is reportedly by a white hacker<ref name="peckshieldtwitter-10928" />.
			\|-
			\|May 5th, 2023 5:18:00 PM MDT
			\|Peckshield Reports A Pubic Burn
			\|Blockchain researchers at Peckshield report a "pubic" burn vulnerability and note the total losses at $1.3m in BSC alone. They note that the BSC funds were front-run by a white hacker and that the ARB/ETH deployments are also affected<ref name="peckshieldtwitter-10928" />.
			\|-
			\|May 5th, 2023 5:31:00 PM MDT
			\|PeckShield Reports Arbitrum Losses
			\|Peckshield reports on losses exceeding $5m on the Arbitrum network, along with the related transaction<ref name=":0">[https://twitter.com/peckshield/status/1654629906637291520 <nowiki>PeckShield - "The arbitrum deployment was hacked [with a] loss [exceeding] $5m [USD] and here is the related t[ransaction]" - Twitter</nowiki>] (May 9, 2023)</ref>.
			\|-
			\|May 5th, 2023 8:14:12 PM MDT
			\|BSC Tokens Transfered
			\|The BSC DEI is transferred again from the second wallet address<ref name="bscscan-10924" /> to another wallet address<ref>[https://bscscan.com/tx/0x6be1cd70eaeb0ea21a5f4fa912fab07b6dce0037aa1f215596f1c6f175818547 BSC Exploit Tokens Transferred - BSCScan] (May 9, 2023)</ref>.
			\|-
			\|May 5th, 2023 9:24:00 PM MDT
			\|MetaSleuth Publishes Analysis
			\|MetaSleuth publishes an analysis on Twitter, reporting that the tokens have been traced to Binance and TornadoCash<ref name="metasleuthtwitter-10923" />.
	\|}		\|}

	== Technical Details ==		== Technical Details ==
	This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?		This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

			=== MetaSleuth Analysis ===
			Technical details on tracing some of the funds were completed by MetaSleuth<ref name="metasleuthtwitter-10923" />.<blockquote>1) On Arb, the exploiter made a profit of over $5M. The initial funds was obtained from TC on BSC. The exploiter swapped most of the profits for 2529 ETH. Besides, they bridged 10k USDC to BSC via @MultichainOrg. Then the exploiter swapped all USDC for ETH and bridged it to ETH.

			2) On BSC, the total profit amounts to around 1.3 million USD. Exploiter 4 obtained the initial funds from Binance. All the profits were transferred to exploiter 6 (0xdf61), then converted into DAI and remained at this address.

			3) On ETH, the total profit is approximately 135,000 USD. The exploiter swapped all the profits for Ether but has not made the transfer yet.</blockquote>

	== Total Amount Lost ==		== Total Amount Lost ==
			PeckShield reported the loss at $1.3m on the BSC chain<ref name="peckshieldtwitter-10928" /> and exceeding $5m on the Arbitrum chain<ref name=":0" />.

			<ref name="etherscan-10927" />

			Ethereum exploiter address: 0x189cf534de3097c08b6beaf6eb2b9179dab122d1<ref name="etherscan-10926" />

			Binance (BSC) white hack exploiter transaction: 0xde2c8718a9efd8db0eaf9d8141089a22a89bca7d1415d04c05ba107dc1a190c3<ref name="bscscan-10925" /> and address 0x08e80ecb146dc0b835cf3d6c48da97556998f599<ref>[https://bscscan.com/tokentxns?a=0x08e80ecb146dc0b835cf3d6c48da97556998f599 Token Transactions of White Hack Exploiter - BSCScan] (May 9, 2023)</ref>.<ref name="bscscan-10924" />

	The total amount lost has been estimated at $6,500,000 USD.		The total amount lost has been estimated at $6,500,000 USD.

Line 141:		Line 180:
	<ref name="arbiscan-10921">[https://arbiscan.io/address/0x189cf534de3097c08b6beaf6eb2b9179dab122d1 Deus DEI Exploiter \| Address 0x189cf534de3097c08b6beaf6eb2b9179dab122d1 \| Arbiscan] (May 8, 2023)</ref>		<ref name="arbiscan-10921">[https://arbiscan.io/address/0x189cf534de3097c08b6beaf6eb2b9179dab122d1 Deus DEI Exploiter \| Address 0x189cf534de3097c08b6beaf6eb2b9179dab122d1 \| Arbiscan] (May 8, 2023)</ref>
	<ref name="arbiscan-10922">[https://arbiscan.io/tx/0xb1141785b7b94eb37c39c37f0272744c6e79ca1517529fec3f4af59d4c3c37ef Arbitrum Transaction Hash (Txhash) Details \| Arbiscan] (May 8, 2023)</ref>		<ref name="arbiscan-10922">[https://arbiscan.io/tx/0xb1141785b7b94eb37c39c37f0272744c6e79ca1517529fec3f4af59d4c3c37ef Arbitrum Transaction Hash (Txhash) Details \| Arbiscan] (May 8, 2023)</ref>
	<ref name="metasleuthtwitter-10923">[https://twitter.com/MetaSleuth/status/1654688526095745024 @~~MetaSleuth~~ Twitter] (May 8, 2023)</ref>		<ref name="metasleuthtwitter-10923">[https://twitter.com/MetaSleuth/status/1654688526095745024 MetaSleuth - "DEI has been exploited on Arbitrum, BSC, and ETH, resulting in a total loss of approximately 6.5 million USD. The initial funds have been traced back to @TornadoCash and @binance." - Twitter] (May 8, 2023)</ref>
	<ref name="bscscan-10924">[https://bscscan.com/address/0x5a647e376d3835b8f941c143af3eb3ddf286c474 Address ~~0x5a647e376d3835b8f941c143af3eb3ddf286c474 \|~~ BscScan] (May 8, 2023)</ref>		<ref name="bscscan-10924">[https://bscscan.com/address/0x5a647e376d3835b8f941c143af3eb3ddf286c474 BSC Whitehack Address - BscScan] (May 8, 2023)</ref>
	<ref name="bscscan-10925">[https://bscscan.com/tx/0xde2c8718a9efd8db0eaf9d8141089a22a89bca7d1415d04c05ba107dc1a190c3 Binance Transaction ~~Hash (Txhash) Details \|~~ BscScan] (May 8, 2023)</ref>		<ref name="bscscan-10925">[https://bscscan.com/tx/0xde2c8718a9efd8db0eaf9d8141089a22a89bca7d1415d04c05ba107dc1a190c3 Binance Exploit Transaction - BscScan] (May 8, 2023)</ref>
	<ref name="etherscan-10926">[https://etherscan.io/address/0x189cf534de3097c08b6beaf6eb2b9179dab122d1 Deus DEI Exploiter \| Address ~~0x189cf534de3097c08b6beaf6eb2b9179dab122d1 \|~~ Etherscan] (May 8, 2023)</ref>		<ref name="etherscan-10926">[https://etherscan.io/address/0x189cf534de3097c08b6beaf6eb2b9179dab122d1 Deus DEI Exploiter Address - Etherscan] (May 8, 2023)</ref>
	<ref name="etherscan-10927">[https://etherscan.io/tx/0x6129dd42778345bc278822a7feadeacb933f5e56ce51114e686832ad239307a8 Ethereum Transaction ~~Hash (Txhash) Details \|~~ Etherscan] (May 8, 2023)</ref>		<ref name="etherscan-10927">[https://etherscan.io/tx/0x6129dd42778345bc278822a7feadeacb933f5e56ce51114e686832ad239307a8 Ethereum Exploit Transaction For 62,287.333509816711554912 DEI - Etherscan] (May 8, 2023)</ref>
	<ref name="peckshieldtwitter-10928">[https://twitter.com/peckshield/status/1654626667787321344 @~~peckshield~~ Twitter] (May 8, 2023)</ref>		<ref name="peckshieldtwitter-10928">[https://twitter.com/peckshield/status/1654626667787321344 peckshield - "Hi @DeusDao: it appears to be a pubic burn vulnerability with loss > $1.3M alone at BSC. The ARB/ETH deployments are also affected." - Twitter] (May 8, 2023)</ref>
	<ref name="deusdaotwitter-10929">[https://twitter.com/DeusDao/status/1654614967084101633 DeusDao - "For all white hackers that were able to rescue funds during the DEI exploit from today" - Twitter] (May 8, 2023)</ref>		<ref name="deusdaotwitter-10929">[https://twitter.com/DeusDao/status/1654614967084101633 DeusDao - "For all white hackers that were able to rescue funds during the DEI exploit from today" - Twitter] (May 8, 2023)</ref>
	<ref name="deusdaotwitter-10930">[https://twitter.com/DeusDao/status/1654614968740851715 DeusDao - "With the help of whitehats and partner projects, the DEUS team paused related contracts and burnt DEI to prevent further damage." - Twitter] (May 8, 2023)</ref>		<ref name="deusdaotwitter-10930">[https://twitter.com/DeusDao/status/1654614968740851715 DeusDao - "With the help of whitehats and partner projects, the DEUS team paused related contracts and burnt DEI to prevent further damage." - Twitter] (May 8, 2023)</ref>

Azoundria: Initial 30 minutes. Down to 12 sources left.

2023-05-08T22:23:29Z

Initial 30 minutes. Down to 12 sources left.

← Older revision		Revision as of 16:23, 8 May 2023
Line 4:		Line 4:
	[[File:Deistablecoin.jpg\|thumb\|DEI Stablecoin]]		[[File:Deistablecoin.jpg\|thumb\|DEI Stablecoin]]

	This is a global/international case not involving a specific country.<ref name="rektnews-10917" /><ref name="adamb83024264twitter-10918" /><ref name="zelliciotwitter-10919" /><ref name="0xprotosectwitter-10920" /><ref name="arbiscan-10921" /><ref name="arbiscan-10922" /><ref name="metasleuthtwitter-10923" /><ref name="bscscan-10924" /><ref name="bscscan-10925" /><ref name="etherscan-10926" /><ref name="etherscan-10927" /><ref name="peckshieldtwitter-10928" /><ref name="deusdaotwitter-10929" /><ref name="deusdaotwitter-10930" /><ref name="deusdaotwitter-10931" /><ref name="hippopotatotwitter-10932" /><ref name="coingecko-9359" /><ref name="deusfinance-9358" /><ref name="deusfinancedocs-10933" /><ref name="deifinanceapp-9357" />		This is a global/international case not involving a specific country.<ref name="rektnews-10917" /><ref name="adamb83024264twitter-10918" /><ref name="zelliciotwitter-10919" /><ref name="0xprotosectwitter-10920" /><ref name="arbiscan-10921" /><ref name="arbiscan-10922" /><ref name="metasleuthtwitter-10923" /><ref name="bscscan-10924" /><ref name="bscscan-10925" /><ref name="etherscan-10926" /><ref name="etherscan-10927" /><ref name="peckshieldtwitter-10928" />

	== About Deus Finance ==		== About Deus Finance ==
			<ref name="coingecko-9359" /><ref name="deusfinance-9358" /><ref name="deusfinancedocs-10933" /><ref name="deifinanceapp-9357" />

	"Deus Finance. Universal access to institutional-grade blockchain derivatives. Providing the framework for optimistic on-chain digital derivatives. Capital efficiency, cross-margin between exchanges and market makers, in addition to instant settlement, enables DEUS to offer an unparalleled alternative to TradFi."		"Deus Finance. Universal access to institutional-grade blockchain derivatives. Providing the framework for optimistic on-chain digital derivatives. Capital efficiency, cross-margin between exchanges and market makers, in addition to instant settlement, enables DEUS to offer an unparalleled alternative to TradFi."

Line 81:		Line 83:
	\|Exploit on Binance Smart Chain		\|Exploit on Binance Smart Chain
	\|The exploit occured on the Binance smart chain.		\|The exploit occured on the Binance smart chain.
			\|-
			\|May 5th, 2023 12:35:00 PM MDT
			\|Hippo Potato Sounds the Alarm
			\|The Twitter user Hippo Potato sounds the alarm on Twitter<ref>[https://twitter.com/hippo_potato/status/1654555505854152704 Hippo Potato - "DEI/USDC LP on Chronos exploited, do not deposit." - Twitter] (May 8, 2023)</ref>.
	\|-		\|-
	\|May 5th, 2023 12:53:35 PM MDT		\|May 5th, 2023 12:53:35 PM MDT
	\|Exploit on Ethereum		\|Exploit on Ethereum
	\|The exploit occured on the ethereum chain.		\|The exploit occured on the ethereum chain.
			\|-
			\|May 5th, 2023 4:32:00 PM MDT
			\|Acknowledgement By DeusDAO Team
			\|The DeusDAO team acknowledges the attack on Twitter<ref name="deusdaotwitter-10929" /><ref name="deusdaotwitter-10930" /> and requests that users hold off on interacting with their smart contract for the time being<ref name="deusdaotwitter-10931" />. TBD expand and move to other sections.
	\|}		\|}

Line 124:		Line 134:

	== References ==		== References ==
	<references><ref name="rektnews-10917">[https://rekt.news/deus-dao-r3kt/ Rekt - Deus DAO - R3KT] (May 8, 2023)</ref>		<references>
			<ref name="rektnews-10917">[https://rekt.news/deus-dao-r3kt/ Rekt - Deus DAO - R3KT] (May 8, 2023)</ref>
	<ref name="adamb83024264twitter-10918">[https://twitter.com/adamb83024264/status/1654558408803250176 @adamb83024264 Twitter] (May 8, 2023)</ref>		<ref name="adamb83024264twitter-10918">[https://twitter.com/adamb83024264/status/1654558408803250176 @adamb83024264 Twitter] (May 8, 2023)</ref>

	<ref name="zelliciotwitter-10919">[https://twitter.com/zellic_io/status/1654605171333423104 @zellic_io Twitter] (May 8, 2023)</ref>		<ref name="zelliciotwitter-10919">[https://twitter.com/zellic_io/status/1654605171333423104 @zellic_io Twitter] (May 8, 2023)</ref>

	<ref name="0xprotosectwitter-10920">[https://twitter.com/0xProtosec/status/1654592710546960385 @0xProtosec Twitter] (May 8, 2023)</ref>		<ref name="0xprotosectwitter-10920">[https://twitter.com/0xProtosec/status/1654592710546960385 @0xProtosec Twitter] (May 8, 2023)</ref>

	<ref name="arbiscan-10921">[https://arbiscan.io/address/0x189cf534de3097c08b6beaf6eb2b9179dab122d1 Deus DEI Exploiter \| Address 0x189cf534de3097c08b6beaf6eb2b9179dab122d1 \| Arbiscan] (May 8, 2023)</ref>		<ref name="arbiscan-10921">[https://arbiscan.io/address/0x189cf534de3097c08b6beaf6eb2b9179dab122d1 Deus DEI Exploiter \| Address 0x189cf534de3097c08b6beaf6eb2b9179dab122d1 \| Arbiscan] (May 8, 2023)</ref>

	<ref name="arbiscan-10922">[https://arbiscan.io/tx/0xb1141785b7b94eb37c39c37f0272744c6e79ca1517529fec3f4af59d4c3c37ef Arbitrum Transaction Hash (Txhash) Details \| Arbiscan] (May 8, 2023)</ref>		<ref name="arbiscan-10922">[https://arbiscan.io/tx/0xb1141785b7b94eb37c39c37f0272744c6e79ca1517529fec3f4af59d4c3c37ef Arbitrum Transaction Hash (Txhash) Details \| Arbiscan] (May 8, 2023)</ref>

	<ref name="metasleuthtwitter-10923">[https://twitter.com/MetaSleuth/status/1654688526095745024 @MetaSleuth Twitter] (May 8, 2023)</ref>		<ref name="metasleuthtwitter-10923">[https://twitter.com/MetaSleuth/status/1654688526095745024 @MetaSleuth Twitter] (May 8, 2023)</ref>

	<ref name="bscscan-10924">[https://bscscan.com/address/0x5a647e376d3835b8f941c143af3eb3ddf286c474 Address 0x5a647e376d3835b8f941c143af3eb3ddf286c474 \| BscScan] (May 8, 2023)</ref>		<ref name="bscscan-10924">[https://bscscan.com/address/0x5a647e376d3835b8f941c143af3eb3ddf286c474 Address 0x5a647e376d3835b8f941c143af3eb3ddf286c474 \| BscScan] (May 8, 2023)</ref>

	<ref name="bscscan-10925">[https://bscscan.com/tx/0xde2c8718a9efd8db0eaf9d8141089a22a89bca7d1415d04c05ba107dc1a190c3 Binance Transaction Hash (Txhash) Details \| BscScan] (May 8, 2023)</ref>		<ref name="bscscan-10925">[https://bscscan.com/tx/0xde2c8718a9efd8db0eaf9d8141089a22a89bca7d1415d04c05ba107dc1a190c3 Binance Transaction Hash (Txhash) Details \| BscScan] (May 8, 2023)</ref>

	<ref name="etherscan-10926">[https://etherscan.io/address/0x189cf534de3097c08b6beaf6eb2b9179dab122d1 Deus DEI Exploiter \| Address 0x189cf534de3097c08b6beaf6eb2b9179dab122d1 \| Etherscan] (May 8, 2023)</ref>		<ref name="etherscan-10926">[https://etherscan.io/address/0x189cf534de3097c08b6beaf6eb2b9179dab122d1 Deus DEI Exploiter \| Address 0x189cf534de3097c08b6beaf6eb2b9179dab122d1 \| Etherscan] (May 8, 2023)</ref>

	<ref name="etherscan-10927">[https://etherscan.io/tx/0x6129dd42778345bc278822a7feadeacb933f5e56ce51114e686832ad239307a8 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (May 8, 2023)</ref>		<ref name="etherscan-10927">[https://etherscan.io/tx/0x6129dd42778345bc278822a7feadeacb933f5e56ce51114e686832ad239307a8 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (May 8, 2023)</ref>

	<ref name="peckshieldtwitter-10928">[https://twitter.com/peckshield/status/1654626667787321344 @peckshield Twitter] (May 8, 2023)</ref>		<ref name="peckshieldtwitter-10928">[https://twitter.com/peckshield/status/1654626667787321344 @peckshield Twitter] (May 8, 2023)</ref>
			<ref name="deusdaotwitter-10929">[https://twitter.com/DeusDao/status/1654614967084101633 DeusDao - "For all white hackers that were able to rescue funds during the DEI exploit from today" - Twitter] (May 8, 2023)</ref>
	<ref name="deusdaotwitter-10929">[https://twitter.com/DeusDao/status/1654614967084101633 @DeusDao Twitter] (May 8, 2023)</ref>		<ref name="deusdaotwitter-10930">[https://twitter.com/DeusDao/status/1654614968740851715 DeusDao - "With the help of whitehats and partner projects, the DEUS team paused related contracts and burnt DEI to prevent further damage." - Twitter] (May 8, 2023)</ref>
			<ref name="deusdaotwitter-10931">[https://twitter.com/DeusDao/status/1654614970141753347 DeusDao - "We will follow up with a Post Mortem and formulate a recovery plan in the upcoming days." - Twitter] (May 8, 2023)</ref>
	<ref name="deusdaotwitter-10930">[https://twitter.com/DeusDao/status/1654614968740851715 @DeusDao Twitter] (May 8, 2023)</ref>

	<ref name="deusdaotwitter-10931">[https://twitter.com/DeusDao/status/1654614970141753347 @DeusDao Twitter] (May 8, 2023)</ref>

	<ref name="hippopotatotwitter-10932">[https://twitter.com/hippo_potato/status/1654555505854152704 @hippo_potato Twitter] (May 8, 2023)</ref>		<ref name="hippopotatotwitter-10932">[https://twitter.com/hippo_potato/status/1654555505854152704 @hippo_potato Twitter] (May 8, 2023)</ref>
			<ref name="coingecko-9359">https://www.coingecko.com/en/coins/dei-token (Oct 26, 2022)</ref>
	<ref name="coingecko-9359">~~[https://www.coingecko.com/en/coins/dei-token~~ https://www.coingecko.com/en/coins/dei-token] (Oct 26, 2022)</ref>		<ref name="deusfinance-9358">https://deus.finance/ (Oct 26, 2022)</ref>

	<ref name="deusfinance-9358">~~[https://deus.finance/~~ https://deus.finance/] (Oct 26, 2022)</ref>

	<ref name="deusfinancedocs-10933">[https://docs.deus.finance/getting-started/new-to-deus New to DEUS? - DEUS Finance Gitbook] (May 8, 2023)</ref>		<ref name="deusfinancedocs-10933">[https://docs.deus.finance/getting-started/new-to-deus New to DEUS? - DEUS Finance Gitbook] (May 8, 2023)</ref>
			<ref name="deifinanceapp-9357">https://app.dei.finance/dashboard (Oct 26, 2022)</ref>
	<ref name="deifinanceapp-9357">[https://app.dei.finance/dashboard ~~https://app.dei.finance/dashboard]~~ (Oct 26, 2022)</ref></references>		</references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/deusfinancedeistablecoinburnvulnerability.php}} {{Unattributed Sources}} DEI Stablecoin This is a global/international case not involving a specific country.
2023-05-08T22:15:51Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/deusfinancedeistablecoinburnvulnerability.php}} {{Unattributed Sources}} thumb|DEI Stablecoin This is a global/international case not involving a specific country.<ref name="rektnews-10917" /><ref name="adamb83024264twitter-10918" /><ref name="zelliciotwitter-10919" /><ref name="0xprotosectwitter-10920" /><ref name="arbiscan-10921" /><ref name="arbiscan-10922" /><ref na..."

New page
{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/deusfinancedeistablecoinburnvulnerability.php}}
{{Unattributed Sources}}

[[File:Deistablecoin.jpg|thumb|DEI Stablecoin]]

This is a global/international case not involving a specific country.<ref name="rektnews-10917" /><ref name="adamb83024264twitter-10918" /><ref name="zelliciotwitter-10919" /><ref name="0xprotosectwitter-10920" /><ref name="arbiscan-10921" /><ref name="arbiscan-10922" /><ref name="metasleuthtwitter-10923" /><ref name="bscscan-10924" /><ref name="bscscan-10925" /><ref name="etherscan-10926" /><ref name="etherscan-10927" /><ref name="peckshieldtwitter-10928" /><ref name="deusdaotwitter-10929" /><ref name="deusdaotwitter-10930" /><ref name="deusdaotwitter-10931" /><ref name="hippopotatotwitter-10932" /><ref name="coingecko-9359" /><ref name="deusfinance-9358" /><ref name="deusfinancedocs-10933" /><ref name="deifinanceapp-9357" />

== About Deus Finance ==
"Deus Finance. Universal access to institutional-grade blockchain derivatives. Providing the framework for optimistic on-chain digital derivatives. Capital efficiency, cross-margin between exchanges and market makers, in addition to instant settlement, enables DEUS to offer an unparalleled alternative to TradFi."

"DEUS Finance is building an infrastructure layer for peer-to-peer, on-chain derivatives. DEUS v3 utilizes bilateral agreements, meaning both parties lock collateral into a trade, with every trade isolated, and settlements automated."

"DEUS connects traders and counterparties directly. Instead of the common LP-centric models, where liquidity providers take on the systemic risk, DEUS isolates risk per trade between the two parties. DEUS is currently primarily (majority of the liquidity) on the Fantom network, however, DEUS v3 can and will be deployed on multiple chains."

"The DEUS ecosystem has two tokens, $DEUS and $xDEUS, and an algorithmic stablecoin, $DEI." "Users interacting with this software do so entirely at their own risk"

DEI is "The global settlement currency of DEUS's Decentralized FIX" "Traders using DEI will enjoy better fee structures while trading derivatives on DEUS v3."

"DEI is an fractional reserve stablecoin, forked and inspired by frax.finance and can be used as a unit of account for derivative-based trading on protocols built on the DEUS infrastructure layer. Traders, Protocols and Market Makers utilizing and offering trading via DEUS v3 using $DEI as stablecoin will enjoy better Fee Structures, than when using $USDC."

"DEI has a 100% minting ratio and 9% seignorage. 100% USDC is required to mint $DEI (ie. $1 USDC is required to mint 1 $DEI). On mint, 9% is used to buy back $DEUS and deposited into the DEI redemption contract. On redemption, 9% is transferred out of the redemption contract. This figure adjusts constantly and can be viewed in the minter stats."

"A simple implementation error was introduced into the DEI token contract, in an upgrade last month. The burnFrom function was misconfigured, with the ‘_allowances’ parameters ‘msgSender’ and ‘account’ written into the contract in the wrong order.

This created a public (or pubic, according to Peckshield) burn vulnerability, which an attacker is then able to manipulate and gain control of DEI holders’ approvals and transfer assets directly to their own address.

The mis-ordered parameters allow the attacker to set a large token approval for any DEI holder’s address. Then, by burning 0 tokens from the address, the approval is updated to the attacker’s address, who can drain the holder’s funds."

"According to BlockSec’s MetaSleuth, the losses were approximately $5M on Arbitrum, $1.3M on BSC and $135k on Ethereum." "Token holders lost a total of ~$6.5M on Arbitrum, BSC and Etherum, and the DEI stablecoin depegged over 80%."

"An official update mentions a recovery plan for users who lost out in the exploit, and Deus have reached out to the attacker on-chain.

But given the account was originally funded via Tornado Cash on BSC, it’s not looking good."

"Luckily, the exploit on BSC was frontrun, and an on-chain message to the Deus Deployer shows the intent to return the funds. Other whitehats also sprang into action, and over $600k in USDC has so far been returned to a recovery multisig."

"For all white hackers that were able to rescue funds during the DEI exploit from today 05/05/2023
We are confirming 0x7f5ae1dc8d2b5d599409c57978d21cf596d37996
As a DEUS team owned multisig on Arbitrum. Please get in touch with us if you have not already."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Deus Finance (DEI Stablecoin) Burn Vulnerability
!Date
!Event
!Description
|-
|May 5th, 2023 11:52:45 AM MDT
|Exploit on Arbitrum
|The exploit occured on the arbitrum chain.
|-
|May 5th, 2023 11:53:35 AM MDT
|Exploit on Binance Smart Chain
|The exploit occured on the Binance smart chain.
|-
|May 5th, 2023 12:53:35 PM MDT
|Exploit on Ethereum
|The exploit occured on the ethereum chain.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $6,500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rektnews-10917">[https://rekt.news/deus-dao-r3kt/ Rekt - Deus DAO - R3KT] (May 8, 2023)</ref>

<ref name="adamb83024264twitter-10918">[https://twitter.com/adamb83024264/status/1654558408803250176 @adamb83024264 Twitter] (May 8, 2023)</ref>

<ref name="zelliciotwitter-10919">[https://twitter.com/zellic_io/status/1654605171333423104 @zellic_io Twitter] (May 8, 2023)</ref>

<ref name="0xprotosectwitter-10920">[https://twitter.com/0xProtosec/status/1654592710546960385 @0xProtosec Twitter] (May 8, 2023)</ref>

<ref name="arbiscan-10921">[https://arbiscan.io/address/0x189cf534de3097c08b6beaf6eb2b9179dab122d1 Deus DEI Exploiter | Address 0x189cf534de3097c08b6beaf6eb2b9179dab122d1 | Arbiscan] (May 8, 2023)</ref>

<ref name="arbiscan-10922">[https://arbiscan.io/tx/0xb1141785b7b94eb37c39c37f0272744c6e79ca1517529fec3f4af59d4c3c37ef Arbitrum Transaction Hash (Txhash) Details | Arbiscan] (May 8, 2023)</ref>

<ref name="metasleuthtwitter-10923">[https://twitter.com/MetaSleuth/status/1654688526095745024 @MetaSleuth Twitter] (May 8, 2023)</ref>

<ref name="bscscan-10924">[https://bscscan.com/address/0x5a647e376d3835b8f941c143af3eb3ddf286c474 Address 0x5a647e376d3835b8f941c143af3eb3ddf286c474 | BscScan] (May 8, 2023)</ref>

<ref name="bscscan-10925">[https://bscscan.com/tx/0xde2c8718a9efd8db0eaf9d8141089a22a89bca7d1415d04c05ba107dc1a190c3 Binance Transaction Hash (Txhash) Details | BscScan] (May 8, 2023)</ref>

<ref name="etherscan-10926">[https://etherscan.io/address/0x189cf534de3097c08b6beaf6eb2b9179dab122d1 Deus DEI Exploiter | Address 0x189cf534de3097c08b6beaf6eb2b9179dab122d1 | Etherscan] (May 8, 2023)</ref>

<ref name="etherscan-10927">[https://etherscan.io/tx/0x6129dd42778345bc278822a7feadeacb933f5e56ce51114e686832ad239307a8 Ethereum Transaction Hash (Txhash) Details | Etherscan] (May 8, 2023)</ref>

<ref name="peckshieldtwitter-10928">[https://twitter.com/peckshield/status/1654626667787321344 @peckshield Twitter] (May 8, 2023)</ref>

<ref name="deusdaotwitter-10929">[https://twitter.com/DeusDao/status/1654614967084101633 @DeusDao Twitter] (May 8, 2023)</ref>

<ref name="deusdaotwitter-10930">[https://twitter.com/DeusDao/status/1654614968740851715 @DeusDao Twitter] (May 8, 2023)</ref>

<ref name="deusdaotwitter-10931">[https://twitter.com/DeusDao/status/1654614970141753347 @DeusDao Twitter] (May 8, 2023)</ref>

<ref name="hippopotatotwitter-10932">[https://twitter.com/hippo_potato/status/1654555505854152704 @hippo_potato Twitter] (May 8, 2023)</ref>

<ref name="coingecko-9359">[https://www.coingecko.com/en/coins/dei-token https://www.coingecko.com/en/coins/dei-token] (Oct 26, 2022)</ref>

<ref name="deusfinance-9358">[https://deus.finance/ https://deus.finance/] (Oct 26, 2022)</ref>

<ref name="deusfinancedocs-10933">[https://docs.deus.finance/getting-started/new-to-deus New to DEUS? - DEUS Finance Gitbook] (May 8, 2023)</ref>

<ref name="deifinanceapp-9357">[https://app.dei.finance/dashboard https://app.dei.finance/dashboard] (Oct 26, 2022)</ref></references>