Dexible DEX Aggregator SelfSwap Exploit - Revision history

Azoundria: Completed the 30 minutes now.

2023-05-19T22:30:06Z

Completed the 30 minutes now.

← Older revision		Revision as of 16:30, 19 May 2023
Line 26:		Line 26:
	!Event		!Event
	!Description		!Description
			\|-
			\|February 16th, 2023 7:26:00 AM MST
			\|Dexible Posts about Dexible V2
			\|The Dexible app advertises "fully on chain" and "more complex logic" in a video on Twitter<ref>[https://twitter.com/DexibleApp/status/1626226492509413376 Dexible - Introducing Dexible v2.0, the slumbering giant of #DeFi wakes. Dexible will revolutionize on-chain capital deployment and shake up how aggregators work." - Twitter] (May 19, 2023)</ref>. "Dexible will revolutionize on-chain capital deployment and shake up how aggregators work. Our team will combine 2 years of user testing with a new model for token incentives with $DXBL." They have a goal to "bring all that CeFi liquidity and volume into DeFi"<ref>[https://twitter.com/DexibleApp/status/1626226989274398720 DexibleApp - "What would bring all that CeFi liquidity and volume into DeFi?" - Twitter] (May 19, 2023)</ref>.
	\|-		\|-
	\|February 16th, 2023 8:23:22 PM MST		\|February 16th, 2023 8:23:22 PM MST
Line 98:		Line 102:
	\|RektHQ Report on Situation		\|RektHQ Report on Situation
	\|RektHQ posts about the exploit<ref name=":2">[https://twitter.com/RektHQ/status/1628030868043300865 RektHQ - "@DexibleApp lost a total of $2M on Friday, on Ethereum and Arbitrum." - Twitter] (May 3, 2023)</ref>. Decentralized exchange aggregator, Dexible, lost $2m on Ethereum and Arbitrum after the contracts were exploited, but an official announcement was made over five hours after the alarm was raised. Dexible's tech lead discovered the attack early on, but the Twitter channel was unable to respond in time. When they did respond, Dexible's message came across as tone-deaf and indifferent. Dexible's recently introduced v2 contracts allows users to define their own routing via the selfSwap function, but it doesn't check whether the router address is a DEX by using an on-chain allowlist. The Dexible team released unaudited code based on the experience of their team<ref name="rektnews-10853" />.		\|RektHQ posts about the exploit<ref name=":2">[https://twitter.com/RektHQ/status/1628030868043300865 RektHQ - "@DexibleApp lost a total of $2M on Friday, on Ethereum and Arbitrum." - Twitter] (May 3, 2023)</ref>. Decentralized exchange aggregator, Dexible, lost $2m on Ethereum and Arbitrum after the contracts were exploited, but an official announcement was made over five hours after the alarm was raised. Dexible's tech lead discovered the attack early on, but the Twitter channel was unable to respond in time. When they did respond, Dexible's message came across as tone-deaf and indifferent. Dexible's recently introduced v2 contracts allows users to define their own routing via the selfSwap function, but it doesn't check whether the router address is a DEX by using an on-chain allowlist. The Dexible team released unaudited code based on the experience of their team<ref name="rektnews-10853" />.
			\|-
			\|February 21st, 2023 12:40:00 PM MST
			\|Another DexibleApp Update
			\|DexibleApp posts another update to their community<ref name=":5">[https://twitter.com/DexibleApp/status/1628117375278088192 DexibleApp - "We want to express our sincerest apologies for the events that occurred last Friday. We understand that the exploit caused immense frustration, inconvenience, and loss to our users." - Twitter] (May 19, 2023)</ref>.
	\|-		\|-
	\|March 22nd, 2023 3:56:17 AM MDT		\|March 22nd, 2023 3:56:17 AM MDT
Line 146:		Line 154:
	Out of 14 unique on Ethereum, 4 were exploited.		Out of 14 unique on Ethereum, 4 were exploited.

	A few big whales were exploited accounted for ~85%</blockquote>How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		A few big whales were exploited accounted for ~85%</blockquote>According to a statement from Dexible, after analysis "knew “$2,047,635.17 was exploited from 17 trader addresses. 4 on mainnet, 13 on arbitrum.”<ref name=":4" />

			How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

	== Immediate Reactions ==		== Immediate Reactions ==
Line 181:		Line 191:
	== Ultimate Outcome ==		== Ultimate Outcome ==
	What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?		What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

			<ref name=":5" />

	== Total Amount Recovered ==		== Total Amount Recovered ==
	There do not appear to have been any funds recovered in this case.		There do not appear to have been any funds recovered in this case so far<ref name=":5" />.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?

	== Ongoing Developments ==		== Ongoing Developments ==
	~~What parts of this case are still remaining~~ to be ~~concluded?~~		The DexibleApp team appears to be looking for a backer to assist in a recovery<ref name=":5" />.
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:Individual:Avoid Using Smart Contracts}}		{{Prevention:Individual:Avoid Using Smart Contracts}}

Azoundria: more

2023-05-19T21:12:48Z

← Older revision		Revision as of 15:12, 19 May 2023
Line 2:		Line 2:

	== About Dexible DEX ==		== About Dexible DEX ==
	Dexible is a decentralized exchange (~~dex~~) aggregator and execution management system (EMS) for professional traders and portfolio managers across six major EVM chains and 60+ ~~dexes~~. The platform offers atomic functionality that improves overall performance, and minimizes price impact by splitting large orders into market-impact-minimizing rounds. Dexible offers full trade lifecycle support with detailed pre-trade and post-trade analysis, smart order routing, and post-order analytics. The platform scans all available sources of liquidity on a particular blockchain to optimize outcomes for swaps and checks ~~dexes~~ for their current pricing and available liquidity. Traders can enter and exit large positions in DeFi without fearing market manipulation or MEV<ref name="youtube-10856" /><ref name="dexible-10857" />.<blockquote>"Dexible is a trading engine for pro traders to maximize profitability. Fully noncustodial set-and-forget orders on 6 major EVM chains across 60+ dexes."		Dexible is a decentralized exchange (DEX) aggregator and execution management system (EMS) for professional traders and portfolio managers across six major EVM chains and 60+ DEXes. The platform offers atomic functionality that improves overall performance, and minimizes price impact by splitting large orders into market-impact-minimizing rounds. Dexible offers full trade lifecycle support with detailed pre-trade and post-trade analysis, smart order routing, and post-order analytics. The platform scans all available sources of liquidity on a particular blockchain to optimize outcomes for swaps and checks DEXes for their current pricing and available liquidity. Traders can enter and exit large positions in DeFi without fearing market manipulation or MEV<ref name="youtube-10856" /><ref name="dexible-10857" />.<blockquote>"Dexible is a trading engine for pro traders to maximize profitability. Fully noncustodial set-and-forget orders on 6 major EVM chains across 60+ dexes."

	"Dexible is a decentralized exchange (dex) aggregator and execution management system (EMS) optimizing full trade life-cycle support in DeFi. The platform offers pro traders and portfolio managers core atomic functionality out-of-the-box that vastly improves overall performance." "Dexible is more than a DEX aggregator. It's an Algo Execution Suite for maximizing profitability designed for the pros."		"Dexible is a decentralized exchange (dex) aggregator and execution management system (EMS) optimizing full trade life-cycle support in DeFi. The platform offers pro traders and portfolio managers core atomic functionality out-of-the-box that vastly improves overall performance." "Dexible is more than a DEX aggregator. It's an Algo Execution Suite for maximizing profitability designed for the pros."
Line 13:		Line 13:

	== The Reality ==		== The Reality ==
	There was an unfortunate vulnerability the selfSwap function, which allows users to define their own routing, but did not check if the router address was a DEX. ~~This~~ would allow an attacker to ~~define~~ malicious transaction routing.		There was an unfortunate vulnerability the "selfSwap" function of the Dexible smart contract, which allows users to define their own routing, but did not check if the router address was a DEX. While the intent was to allow users to specify a router, because there was no filter it would allow an attacker to specify a malicious transaction routing contract.

	<ref name="rektnews-10853" />.		<ref name="rektnews-10853" />.
Line 20:		Line 20:

	== What Happened ==		== What Happened ==
	The ~~specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it~~.		The SelfSwap exploit was exploited.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - Dexible DEX Aggregator SelfSwap Exploit		\|+Key Event Timeline - Dexible DEX Aggregator SelfSwap Exploit
Line 90:		Line 90:
	\|Dexible App Reports on Losses		\|Dexible App Reports on Losses
	\|Dexible App posts a Tweet reporting on the total amount lost in the protocol<ref name="dexibleapptwitter-10855" />.		\|Dexible App posts a Tweet reporting on the total amount lost in the protocol<ref name="dexibleapptwitter-10855" />.
			\|-
			\|February 17th, 2023 2:10:00 PM MST
			\|CoinTelegraph Article Published
			\|CoinTelegraph publishes an article on the Dexible vulnerability. The article reports that there is a pop-up on the Dexible website. "he selfSwap function allowed users to provide the address of a router and calldata associated with it to make a swap of one token for another. However, there was no list of preapproved routers written into the code. So, the attacker used this function to route a transaction from Dexible to each token contract, moving users’ tokens from their wallets into the attacker’s own smart contract. Because these malicious transactions were coming from Dexible, which users had already authorized to spend their tokens, the token contracts did not block the transactions."<ref name=":4">[https://cointelegraph.com/news/dexibleapp-aggregator-hacked-for-2m-via-selfswap-function Dexible aggregator hacked for $2M via ‘selfSwap’ function - CoinTelegraph] (May 19, 2023)</ref>
	\|-		\|-
	\|February 21st, 2023 6:56:00 AM MST		\|February 21st, 2023 6:56:00 AM MST
	\|RektHQ Report on Situation		\|RektHQ Report on Situation
	\|RektHQ posts about the exploit<ref name=":2">[https://twitter.com/RektHQ/status/1628030868043300865 RektHQ - "@DexibleApp lost a total of $2M on Friday, on Ethereum and Arbitrum." - Twitter] (May 3, 2023)</ref>. Decentralized exchange aggregator, Dexible, lost $2m on Ethereum and Arbitrum after the contracts were exploited, but an official announcement was made over five hours after the alarm was raised. Dexible's tech lead discovered the attack early on, but the Twitter channel was unable to respond in time. When they did respond, Dexible's message came across as tone-deaf and indifferent. Dexible's recently introduced v2 contracts allows users to define their own routing via the selfSwap function, but it doesn't check whether the router address is a DEX by using an on-chain allowlist. The Dexible team released unaudited code based on the experience of their team<ref name="rektnews-10853" />.		\|RektHQ posts about the exploit<ref name=":2">[https://twitter.com/RektHQ/status/1628030868043300865 RektHQ - "@DexibleApp lost a total of $2M on Friday, on Ethereum and Arbitrum." - Twitter] (May 3, 2023)</ref>. Decentralized exchange aggregator, Dexible, lost $2m on Ethereum and Arbitrum after the contracts were exploited, but an official announcement was made over five hours after the alarm was raised. Dexible's tech lead discovered the attack early on, but the Twitter channel was unable to respond in time. When they did respond, Dexible's message came across as tone-deaf and indifferent. Dexible's recently introduced v2 contracts allows users to define their own routing via the selfSwap function, but it doesn't check whether the router address is a DEX by using an on-chain allowlist. The Dexible team released unaudited code based on the experience of their team<ref name="rektnews-10853" />.
			\|-
			\|March 22nd, 2023 3:56:17 AM MDT
			\|Hacken Smart Contract Guide Includes Exploit
			\|Hacken updates their guide on "Smart Contract Vulnerabilities & How to Prevent Them" to also include a section with an "[e]xample of the Dexible exploit"<ref>[https://hacken.io/discover/smart-contract-vulnerabilities/ Smart Contract Vulnerabilities & How to Prevent Them - Hacken] (May 19, 2023)</ref>. As they report, "[d]evelopers must implement the necessary security mechanisms to guarantee that external calls are made only to trusted and intended addresses."
	\|}		\|}

	== Technical Details ==		== Technical Details ==

			The hacker exploited this vulnerability by calling a token contract with a request to "transferFrom" any account that had spend approval on the Dexible contract. The core engineer who created the contracts did not see the vulnerability initially, but after reviewing the hacker's transaction, he immediately understood how it was executed. Dexible has published a post-mortem report explaining the issue

	The ~~hacker exploited~~ this ~~vulnerability by calling~~ a token contract ~~with a request to "transferFrom" any account that had spend approval on~~ the ~~Dexible~~ contract. ~~The core engineer who created~~ the contracts did not ~~see~~ the ~~vulnerability initially, but after reviewing the hacker's transaction, he immediately understood how it was executed~~. ~~Dexible has published a post-mortem report explaining the issue~~		=== CoinTelegraph Description ===
			CoinTelegraph published a description of the exploit<ref name=":4" />.<blockquote>
			The selfSwap function allowed users to provide the address of a router and calldata associated with it to make a swap of one token for another. However, there was no list of preapproved routers written into the code. So, the attacker used this function to route a transaction from Dexible to each token contract, moving users’ tokens from their wallets into the attacker’s own smart contract. Because these malicious transactions were coming from Dexible, which users had already authorized to spend their tokens, the token contracts did not block the transactions.</blockquote>

	== Total Amount Lost ==		== Total Amount Lost ==

Azoundria: Start of this one.

2023-05-19T20:02:36Z

Start of this one.

← Older revision		Revision as of 14:02, 19 May 2023
Line 13:		Line 13:

	== The Reality ==		== The Reality ==
	~~Dexible did not perform a formal audit on its latest set of contracts, but several community members and engineers reviewed the code and did not find the vulnerability. The~~ vulnerability ~~was found in~~ the selfSwap function, which allows users to define their own routing, but ~~does~~ not check if the router address is a DEX. ~~The hacker exploited this vulnerability by calling a token contract with a request~~ to ~~"transferFrom" any account that had spend approval on the Dexible contract. The core engineer who created the contracts did not see the vulnerability initially, but after reviewing the hacker's~~ transaction~~, he immediately understood how it was executed~~. ~~Dexible has published a post-mortem report explaining the issue~~<ref name="rektnews-10853" />.		There was an unfortunate vulnerability the selfSwap function, which allows users to define their own routing, but did not check if the router address was a DEX. This would allow an attacker to define malicious transaction routing.

			<ref name="rektnews-10853" />.

			The issue was obvious in hindsight, and would have likely been caught with a proper audit of the smart contract code. However, Dexible did not perform a formal audit on this set of contracts. Instead, they report that several community members and engineers reviewed the code and did not find the vulnerability.

	== What Happened ==		== What Happened ==
Line 93:		Line 97:

	== Technical Details ==		== Technical Details ==
	~~This section includes specific detailed technical analysis of~~ any ~~security breaches which happened~~. ~~What specific software vulnerabilities contributed to~~ the ~~problem and~~ how ~~were they exploited?~~

			The hacker exploited this vulnerability by calling a token contract with a request to "transferFrom" any account that had spend approval on the Dexible contract. The core engineer who created the contracts did not see the vulnerability initially, but after reviewing the hacker's transaction, he immediately understood how it was executed. Dexible has published a post-mortem report explaining the issue

	== Total Amount Lost ==		== Total Amount Lost ==
Line 137:		Line 143:


	~~How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?~~


	"The decentralised exchange aggregator, Dexible lost a total of $2M on Friday, on Ethereum and Arbitrum.		"The decentralised exchange aggregator, Dexible lost a total of $2M on Friday, on Ethereum and Arbitrum.
Line 172:		Line 179:
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:~~Individuals~~:~~Placeholder~~}}		{{Prevention:Individual:Avoid Using Smart Contracts}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	{{Prevention:Platforms:~~Placeholder~~}}		{{Prevention:Platforms:Regular Audit Procedures}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	{{Prevention:Regulators:~~Placeholder~~}}		{{Prevention:Regulators:Platform Security Assessments}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria: 30 more minutes completed.

2023-05-05T22:27:47Z

30 more minutes completed.

@@ Line 22: / Line 22: @@
 !Event
 !Description
 |-
 |February 16th, 2023 9:20:35 PM MST
 |Exploit Transaction
-|One of the exploit transactions on the blockchain<ref name="etherscan-10859" />.
+|The second exploit transactions for 17,960,937.5 TrueFI tokens<ref name="etherscan-10859" />. This transaction is the most widely referenced attack transaction example<ref name="peckshieldtwitter-10858" /><ref name=":2" />.
 |-
 |February 16th, 2023 10:00:00 PM MST
 |Smart Contract Paused
 |According to a later Tweet by Dexible App, the smart contract was paused at 5 AM UTC<ref name=":0">[https://twitter.com/DexibleApp/status/1626579165393698816 DexibleApp - "Protocol was paused  at 5:00 AM UTC this morning." - Twitter] (May 3, 2023)</ref>.
 |-
 |February 17th, 2023 1:05:00 AM MST
@@ Line 38: / Line 62: @@
 |PechShield Reports Contract Paused
 |PeckShield reports on Twitter that the protocol should now be paused<ref>[https://twitter.com/peckshield/status/1626493808975433730 PeckShield - "The protocol should be now paused." - Twitter] (May 3, 2023)</ref>.
 |-
 |February 17th, 2023 6:35:00 AM MST
@@ Line 53: / Line 89: @@
 |February 21st, 2023 6:56:00 AM MST
 |RektHQ Report on Situation
-|RektHQ posts about the exploit<ref>[https://twitter.com/RektHQ/status/1628030868043300865 RektHQ - "@DexibleApp lost a total of $2M on Friday, on Ethereum and Arbitrum." - Twitter] (May 3, 2023)</ref>. Decentralized exchange aggregator, Dexible, lost $2m on Ethereum and Arbitrum after the contracts were exploited, but an official announcement was made over five hours after the alarm was raised. Dexible's tech lead discovered the attack early on, but the Twitter channel was unable to respond in time. When they did respond, Dexible's message came across as tone-deaf and indifferent. Dexible's recently introduced v2 contracts allows users to define their own routing via the selfSwap function, but it doesn't check whether the router address is a DEX by using an on-chain allowlist. The Dexible team released unaudited code based on the experience of their team<ref name="rektnews-10853" />.
+|RektHQ posts about the exploit<ref name=":2">[https://twitter.com/RektHQ/status/1628030868043300865 RektHQ - "@DexibleApp lost a total of $2M on Friday, on Ethereum and Arbitrum." - Twitter] (May 3, 2023)</ref>. Decentralized exchange aggregator, Dexible, lost $2m on Ethereum and Arbitrum after the contracts were exploited, but an official announcement was made over five hours after the alarm was raised. Dexible's tech lead discovered the attack early on, but the Twitter channel was unable to respond in time. When they did respond, Dexible's message came across as tone-deaf and indifferent. Dexible's recently introduced v2 contracts allows users to define their own routing via the selfSwap function, but it doesn't check whether the router address is a DEX by using an on-chain allowlist. The Dexible team released unaudited code based on the experience of their team<ref name="rektnews-10853" />.
 |}
@@ Line 60: / Line 96: @@
 == Total Amount Lost ==
 The total amount lost has been estimated at $1,530,000 USD.
@@ Line 71: / Line 132: @@
 == Immediate Reactions ==
 How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?
@@ Line 128: / Line 194: @@
 <ref name="dexible-10857">[https://dexible.gitbook.io/dexible/ Start Here - Dexible] (May 3, 2023)</ref>
 <ref name="peckshieldtwitter-10858">[https://twitter.com/peckshield/status/1626493024879673344 <nowiki>peckshield - "Hi @DexibleApp, you may need to ask users to revoke allowance! (The loss is already >$1.5M). Here is one hack [transaction]" - Twitter</nowiki>] (May 3, 2023)</ref>
-<ref name="etherscan-10859">[https://etherscan.io/tx/0x138daa4cbeaa3db42eefcec26e234fc2c89a4aa17d6b1870fc460b2856fd11a6 Ethereum Transaction Exploiting Dexible DEX - Etherscan] (May 3, 2023)</ref>
+<ref name="etherscan-10859">[https://etherscan.io/tx/0x138daa4cbeaa3db42eefcec26e234fc2c89a4aa17d6b1870fc460b2856fd11a6 Transaction Exploiting Dexible DEX For 17,960,937.5 TrueFi - Etherscan] (May 3, 2023)</ref>
 </references>

Azoundria: Initial 30 minutes. All sources integrated.

2023-05-04T02:06:51Z

Initial 30 minutes. All sources integrated.

Show changes

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/dexibledexaggregatorselfswapexploit.php}} {{Unattributed Sources}} Dexible DEX AggregatorDexible is a decentralized exchange (DEX) aggregator and execution management system (EMS) that optimizes full trade lifecycle support in DeFi. The platform offers pro traders and portfolio managers core atomic functionality out-of-the-box that vastly improves overall performance...."

2023-05-04T01:48:20Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/dexibledexaggregatorselfswapexploit.php}} {{Unattributed Sources}} thumb|Dexible DEX AggregatorDexible is a decentralized exchange (DEX) aggregator and execution management system (EMS) that optimizes full trade lifecycle support in DeFi. The platform offers pro traders and portfolio managers core atomic functionality out-of-the-box that vastly improves overall performance...."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/dexibledexaggregatorselfswapexploit.php}}
{{Unattributed Sources}}

[[File:Dexibledex.jpg|thumb|Dexible DEX Aggregator]]Dexible is a decentralized exchange (DEX) aggregator and execution management system (EMS) that optimizes full trade lifecycle support in DeFi. The platform offers pro traders and portfolio managers core atomic functionality out-of-the-box that vastly improves overall performance. With Dexible, traders can enter and exit large positions in DeFi without fearing market manipulation or MEV. However, Dexible suffered a hack on February 17th, 2022, losing a total of $2 million on Ethereum and Arbitrum. Although contracts were quickly paused, an official announcement came more than nine hours after the hack, and over five hours after Peckshield raised the alarm. Approximately $1.5 million was lost on Ethereum, and a further $450k was lost on Arbitrum, which was bridged to BSC before also being washed via Tornado Cash. 17 traders were affected in total, and the exploiter transferred stolen funds of ~930.6 $ETH ($1.53M) into Tornado Cash. Dexible has not undergone a formal audit, and one was not performed on the latest set of contracts.

This is a global/international case not involving a specific country.<ref name="rektnews-10853" /><ref name="dexibleapptwitter-10854" /><ref name="dexibleapptwitter-10855" /><ref name="youtube-10856" /><ref name="dexible-10857" /><ref name="peckshieldtwitter-10858" /><ref name="etherscan-10859" />

== About Dexible DEX ==
"Dexible is a trading engine for pro traders to maximize profitability. Fully noncustodial set-and-forget orders on 6 major EVM chains across 60+ dexes."

"Dexible is a decentralized exchange (dex) aggregator and execution management system (EMS) optimizing full trade life-cycle support in DeFi. The platform offers pro traders and portfolio managers core atomic functionality out-of-the-box that vastly improves overall performance." "Dexible is more than a DEX aggregator. It's an Algo Execution Suite for maximizing profitability designed for the pros."

"Minimizes Price-Impact: Splits large orders into market impact minimizing rounds. Full Trade Lifecycle Support: Detailed pre-trade and post-trade analysis. Post-Order Analytics: View and export detailed trade history reports for reporting and analysis. Smart Order Routing: Taps into 60+ liquidity sources for optimal price discovery."

"Think of Dexible as a highly flexible dex aggregator with an execution layer modeled to resemble OEMS in CeFi & Traditional Finance. The platform scans all the available sources of liquidity on a particular blockchain to optimize outcomes for swaps. Dexible also checks dexes for their current pricing and available liquidity, among other on and off-chain conditions. When market conditions match the trader's criteria, orders get submitted through Dexible's Settlement Smart Contract, then calling out to one or more dex contracts to execute the actual trades."

"With Dexible, traders can enter and exit large positions in DeFi without fearing market manipulation or MEV. With radical financial innovation and growth comes radical investment returns and opportunity, leading to more institutional capital flooding into the ecosystem."

"A formal audit was not performed on the latest set of contracts. We had several community members and Dexible engineers review the code, and they did not find the vulnerability. The core engineer that created the contracts has over 25 years of software engineering experience, and he did not see the vulnerability. Upon reviewing one of the hacker's transactions, however, he immediately understood how it was executed."

"One feature of Dexible’s recently introduced v2 contracts allows users to define their own routing via the selfSwap function. Dexible’s post-mortem report (published via Telegram and Discord, in PDF format) explains:

embedded in each request to swap was a "route" of what DEX to call and what data to send to that DEX to execute a swap

However, the function does not check whether the router address is actually a DEX by, for example, using an on-chain allowlist:

the router address was not verified on-chain in any way. This meant that instead of calling a DEX smart contract, the hacker simply called a token contract with a request to "transferFrom" any account that had spend approval on the Dexible contract"

"The decentralised exchange aggregator, Dexible lost a total of $2M on Friday, on Ethereum and Arbitrum.

Although contracts were quickly paused, an official announcement came more than 9 hours after the hack, and over five hours after Peckshield raised the alarm.

The thread states that their tech lead “discovered the attack early on” but that the “Twitter channel was not able to respond in time”, despite various promotional tweets being published in the intervening hours."

"Relatively few addresses were affected, with the majority of losses reportedly coming from an address belonging to BlockTower Capital which lost 18M TRU tokens, valued at ~$1.4M at the time.

In total, approximately $1.5M was lost on Ethereum, and sent to Tornado Cash. A further $450k was lost on Arbitrum, which was bridged to BSC before also being washed via Tornado Cash."

"Dear Dexible community, we regret to inform you that in the early hours of February 17th, a hacker exploited a vulnerability in our newest smart contract. This allowed the hacker to steal funds from any wallet that had an unspent spend approval on the contract."

"We are taking this very seriously, and our team immediately paused all Dexible contracts on all chains upon detecting the issue. Our users were affected, but the exploit is over."

"We are grateful to our tech lead, who discovered the attack early on. Unfortunately, our Twitter channel was not able to respond in time. Statements were made on Discord and Telegram."

"Several team members were up overnight to contain the exploit.

As we write this statement, the team is in a war room to develop the next steps, create a triage plan, and gather the data."

"Update: 17 traders were affected total, 4 on Mainnet, 13 on Arbitrum.

Out of 36 on Arbitrum, only 13 were exploited.

Out of 14 unique on Ethereum, 4 were exploited.

A few big whales were exploited accounted for ~85%"

"The Exploiter has transferred stolen funds ~930.6 $ETH (~1.53M) into Tornado Cash"

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Dexible DEX Aggregator SelfSwap Exploit
!Date
!Event
!Description
|-
|February 16th, 2023 9:20:35 PM MST
|Exploit Transaction
|One of the exploit transactions on the blockchain.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $1,530,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rektnews-10853">[https://rekt.news/dexible-rekt/ Rekt - Dexible - REKT] (May 3, 2023)</ref>

<ref name="dexibleapptwitter-10854">[https://twitter.com/DexibleApp/status/1626575966003757056 @DexibleApp Twitter] (May 3, 2023)</ref>

<ref name="dexibleapptwitter-10855">[https://twitter.com/DexibleApp/status/1626592861050527745 @DexibleApp Twitter] (May 3, 2023)</ref>

<ref name="youtube-10856">[https://www.youtube.com/watch?v=Rhmrs0lxldY Introducing Dexible - Algo Trading Dex Aggregator for DeFi Portfolio Managers - YouTube] (May 3, 2023)</ref>

<ref name="dexible-10857">[https://dexible.gitbook.io/dexible/ Start Here - Dexible] (May 3, 2023)</ref>

<ref name="peckshieldtwitter-10858">[https://twitter.com/peckshield/status/1626493024879673344 @peckshield Twitter] (May 3, 2023)</ref>

<ref name="etherscan-10859">[https://etherscan.io/tx/0x138daa4cbeaa3db42eefcec26e234fc2c89a4aa17d6b1870fc460b2856fd11a6 Ethereum Transaction Hash (Txhash) Details | Etherscan] (May 3, 2023)</ref></references>