Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/oasisapplicationwalletsoftwareexploited.php}} {{Unattributed Sources}} OASIS App (Now Summer.Fi)Oasis, a frontend for the MakerDAO project, aimed to provide a trusted entry point for users to deploy their capital in DeFi. Users could borrow Dai or buy additional collateral to increase their exposure to crypto by opening a Maker Vault and depositing 25+ crypto collateral..."

2023-11-23T19:39:06Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/oasisapplicationwalletsoftwareexploited.php}} {{Unattributed Sources}} thumb|OASIS App (Now Summer.Fi)Oasis, a frontend for the MakerDAO project, aimed to provide a trusted entry point for users to deploy their capital in DeFi. Users could borrow Dai or buy additional collateral to increase their exposure to crypto by opening a Maker Vault and depositing 25+ crypto collateral..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/oasisapplicationwalletsoftwareexploited.php}}
{{Unattributed Sources}}

[[File:Oasisapp.jpg|thumb|OASIS App (Now Summer.Fi)]]Oasis, a frontend for the MakerDAO project, aimed to provide a trusted entry point for users to deploy their capital in DeFi. Users could borrow Dai or buy additional collateral to increase their exposure to crypto by opening a Maker Vault and depositing 25+ crypto collaterals. However, Oasis faced controversy when a previously unknown vulnerability in the design of its admin multisig access allowed the retrieval of assets stolen in the February 2022 Wormhole bridge exploit. Following a court order, Oasis cooperated in the retrieval using the multisig and a court-authorized third party. The incident sparked concerns about the platform's upgradability and its potential implications for decentralized finance. Oasis responded by making its automation contracts fully decentralized and immutable, removing the ability to upgrade any associated contracts. The platform has also ultimately rebranded themselves as Summer Finance (summer.fi).

This is a global/international case not involving a specific country.<ref name="funominalletwitter-12435" /><ref name="oasisapparchive-12436" /><ref name="oasisappblogarchive-12437" /><ref name="oasisappblogarchive-12438" /><ref name="summerfi-12439" /><ref name="chrisbduckytwitter-12440" /><ref name="etherscan-12441" /><ref name="oasisapparchive-12442" /><ref name="web3isgoinggreat-12443" /><ref name="coindesk-12444" /><ref name="redditold-12445" />

== About OASIS.App ==
"Borrow Dai and Multiply your exposure to crypto. Open a Maker Vault, deposit 25+ crypto collaterals. Either borrow Dai or buy additional collateral to increase your exposure. Connect a wallet to start."

"Oasis mission is to provide the best and most trusted entry point to deploy your capital. We are building Oasis.app to let our users benefit from all of the potential in DeFi. Our team is made of passionate thinkers and builders."

"Oasis is a frontend for the MakerDAO project, which was originally started as part of MakerDAO but later spun into a separate entity, though it still appears to enjoy preferred status by MakerDAO."

"why were some upgradeable in the first place? Well this is a simple answer - we pride ourselves at Oasis on great UX and trust, and ultimately users want to know that 1) when they set something" "like automation up, they trust that it will always work for them, and 2) they are doing this to optimise or protect their funds - they don't want lose their assets due to a bug or another hacker stealing them. So yes, we had certain contracts that were upgradeable, such as" "the exchange contract, so that if a bug was discovered in say 1inch, which we use to perform the swaps for automation, or perhaps a third party could pass in something that caused a risk to user funds, that we would be able to move quickly and remove this risk to users."

"Our team first became aware of the possibility to assist in the retrieval of the assets after a Whitehat group reached out to the team on the evening of Thursday 16th February 2023, that showed it would be possible to retrieve the assets and provided a Proof of Concept on how it could be achieved. What occurred on 21st February 2023 was only possible due to a previously unknown vulnerability in the design of the admin multisig access. We stress that this access was there with the sole intention to protect user assets in the event of any potential attack, and would have allowed us to move quickly to patch any vulnerability disclosed to us. It should be noted that at no point, in the past or present, have user assets been at risk of being accessed by any unauthorised party."

"On 21st February 2023, we received an order from the High Court of England and Wales to take all necessary steps that would result in the retrieval of certain assets involved with the wallet address associated with the Wormhole Exploit on the 2nd February 2022. This was carried out in accordance with the requirements of the court order, as required by law, using the Oasis Multisig and a court authorised third party"

"The stolen funds in question were the proceeds of the February 2022 Wormhole bridge exploit, in which attackers stole 120,000 wETH (then ~$326 million; now $192 million). After the hack, Wormhole's parent company Jump Crypto plugged the hole left by the hack with their own funds. Since then, the attackers have been moving the funds throughout the cryptocurrency ecosystem, even taking out a highly-leveraged position on in Lido-staked Ether last month."

"We can also confirm the assets were immediately passed onto a wallet controlled by the authorised third party, as required by the court order. We retain no control or access to these assets."

"We are thankful to the Whitehat group for their intervention, which represents an example of how important the community is in our space at this stage. Our mission keeps being to be the most trusted place to deploy and manage your capital in DeFi."

"Ultimately, Jump was able to recover around $140 million via their "counter-exploit". While many celebrated the recovery, some were concerned about the precedent of a so-called defi platform changing a smart contract to remove funds from a wallet at the direction of a court. Some described the upgradability as a "backdoor"."

"Speaking of music industry rugs promoted by “celebrities” check out $OASIS"

"If they'd do it for Jump, what does that say about possible coercion via state actors?" wrote one trader on Twitter."

"Are they so incompetent they cant make a proper multi-sig wallet or was this a deliberate backdoor. Either way you shouldn't be using anything made by this company."

"Oasis released a defensive statement, writing that their cooperation in the recovery was "only possible due to a previously unknown vulnerability in the design of the admin multisig access", and that "we will be making no further comment at this time"."

"We have now removed the ability to upgrade any of the contracts associated with Oasis Automation. This has been done by setting the authorized address to the 0x0, instead of the Oasis Multisig."

"Our Automation contracts are now fully decentralized and IMMUTABLE."

"I want to give an update on the incident involving http://Oasis.app and the wormhole exploiter that occurred on Feb 21st. I'm aware we have been quite silent on the matter, but I would like to take the opportunity to clarify a few things."

"This means we can no longer upgrade any of the contracts, and as such, there is no way for the multisig (or any address/contract) to perform any operations similar to the one that happened a few weeks ago again."

"I want to reiterate something very clearly though, that was ignored heavily on the original statement; it was never our intention, or knowledge, that we could actually perform such an operation using the upgradable contracts the way that they were used. Yes we were aware"

"that we allowed some of our contracts to be upgradeable (more on this later), but not all of them - and the ones which were not upgradeable had multiple checks in place, as well as the users automation parameters, which we strongly believed prevented the type of operation."

"what we were not aware of until Feb 16th was that the checks left open the possibility to perform the action that occurred AND still pass the immutable checks that were in place."

"It was a set of actions using a number of functions that we just didn't foresee. And because the main contracts that contain the checks were not upgradeable, it meant it was also not possible to just add these checks in now."

"So we have taken the only route we saw possible in making the 'Counter-Exploit' operation not possible again, and that is removing any ability to upgrade any of the contracts moving forward. So from now, all of the" "Oasis Automation contracts are fully immutable."

"Your funds, your choice: put your capital to work while staying in full control, with no exceptions"

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - OASIS Application Wallet Software Exploited
!Date
!Event
!Description
|-
|February 16th, 2023
|Whitehat Group Report
|A whitehat group reaches out to the OASIS wallet to provide a Proof of Concept for extracting funds from a wallet on the OASIS blockchain.
|-
|February 21st, 2023
|Court Order Received
|The OASIS network reports that they received the court order on February 21st.
|-
|February 24th, 2023 2:22:53 PM MST
|Blog Post About Order
|The blog post is made about the transaction which was executed to freeze and return the funds associated with the Wormhole exploit.
|-
|February 24th, 2023 4:26:34 PM MST
|CoinDesk Article Published
|CoinDesk publishes an article on the exploit and court order.
|-
|February 24th, 2023 4:53:27 PM MST
|Reddit Discussion
|Reddit discussion begins which doesn't reflect well on the service. "Are they so incompetent they cant make a proper multi-sig wallet or was this a deliberate backdoor. Either way you shouldn't be using anything made by this company."
|-
|March 9th, 2023 7:54:47 AM MST
|Upgradeability Removed
|The Oasis application upgradeability has been removed by setting the wallet which controls the upgrade to 0x0.
|-
|March 9th, 2023 10:57:00 AM MST
|Clarification And Patch
|The CEO Chris B reports that they have now made the contract fully immutible and provided the on-chain transaction.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $140,000,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="funominalletwitter-12435">[https://mobile.twitter.com/funominalle/status/1506557173522137090 https://mobile.twitter.com/funominalle/status/1506557173522137090] (Jan 13, 2023)</ref>

<ref name="oasisapparchive-12436">[https://web.archive.org/web/20220105135459/https://oasis.app/ Oasis.app] (Nov 23, 2023)</ref>

<ref name="oasisappblogarchive-12437">[https://web.archive.org/web/20230401130223/https://blog.oasis.app/statement-regarding-the-transactions-from-the-oasis-multisig-on-21st-feb-2023/ <nowiki>[UPDATED] Statement Regarding The Transactions From The Oasis Multisig on 21st Feb 2023 - Oasis Blog</nowiki>] (Nov 23, 2023)</ref>

<ref name="oasisappblogarchive-12438">[https://web.archive.org/web/20230224220308/https://blog.oasis.app/statement-regarding-the-transactions-from-the-oasis-multisig-on-21st-feb-2023/ Statement Regarding The Transactions From The Oasis Multisig on 21st Feb 2023 - Oasis Blog] (Nov 23, 2023)</ref>

<ref name="summerfi-12439">[https://summer.fi/ The best place to Borrow and Earn in DeFi] (Nov 23, 2023)</ref>

<ref name="chrisbduckytwitter-12440">[https://twitter.com/chrisbducky/status/1633889732882227207 @chrisbducky Twitter] (Nov 23, 2023)</ref>

<ref name="etherscan-12441">[https://etherscan.io/tx/0x563a8cedc73c605316296f45d25de89ed647176ef536fbbdd8a78534b38cd590 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Nov 23, 2023)</ref>

<ref name="oasisapparchive-12442">[https://web.archive.org/web/20211030133730/https://oasis.app/about About Us] (Nov 23, 2023)</ref>

<ref name="web3isgoinggreat-12443">[https://web3isgoinggreat.com/?id=oasis-rewrites-the-rules-for-jump-crypto Per a court order, Oasis rewrites the rules for Jump Crypto to recover stolen assets] (Nov 23, 2023)</ref>

<ref name="coindesk-12444">[https://www.coindesk.com/business/2023/02/24/oasis-exploits-its-own-wallet-software-to-seize-crypto-stolen-in-wormhole-hack/ Oasis Exploits Its Own Wallet Software to Seize Crypto Stolen in Wormhole Hack] (Nov 23, 2023)</ref>

<ref name="redditold-12445">[https://old.reddit.com/r/CryptoCurrency/comments/11b62u4/oasis_exploits_its_own_wallet_software_to_seize/ Oasis Exploits its Own Wallet Software to Seize Crypto Stolen in Wormhole Hack : CryptoCurrency] (Nov 23, 2023)</ref></references>

OASIS Application Wallet Software Exploited - Revision history