Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/orionnetworksetliabilityvulnerability.php}} {{Unattributed Sources}} Orion Network Logo/HomepageOrion Network is a protocol designed to help connect decentralized finance to centralized exchange liquidity. Orion Network suffered from a vulnerability where the setLiability function could be called multiple times. The exploit was described as complicated by..."

2024-09-17T19:44:34Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/orionnetworksetliabilityvulnerability.php}} {{Unattributed Sources}} thumb|Orion Network Logo/HomepageOrion Network is a protocol designed to help connect decentralized finance to centralized exchange liquidity. Orion Network suffered from a vulnerability where the setLiability function could be called multiple times. The exploit was described as complicated by..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/orionnetworksetliabilityvulnerability.php}}
{{Unattributed Sources}}

[[File:Orionnetwork.jpg|thumb|Orion Network Logo/Homepage]]Orion Network is a protocol designed to help connect decentralized finance to centralized exchange liquidity. Orion Network suffered from a vulnerability where the setLiability function could be called multiple times. The exploit was described as complicated by analysis firms. The hacker reported that they were a whitehat hacker. They requested a 10% bounty in exchange for returning the rest of the funds.<ref name="slowmisthackedarchive-14249" /><ref name="slowmistteamtwitter-14261" /><ref name="oklink-14262" /><ref name="chainaegistwitter-14263" /><ref name="bscscan-14264" /><ref name="0xnicklfranklintwitter-14265" /><ref name="orion-14266" /><ref name="oriondocs-14267" /><ref name="oriondocs-14268" /><ref name="phalconxyztwitter-14269" /><ref name="phalconxyztwitter-14270" /><ref name="cryptoevgentwitter-14271" /><ref name="cryptoevgentwitter-14272" />

== About Orion Network ==
"EARN MORE WITH ORION. SAVE TIME WITH ORION. STAY SECURE WITH ORION." "Best prices. Your wallet. Global access."

"Orion is on a transformative mission to redefine DeFi trading, seamlessly connecting the vast liquidity of both centralized and decentralized exchanges directly from your wallet. We aim to be the people's platform, ensuring democratized access to the best crypto prices while redistributing wealth back to our users worldwide.

Our vision aims to dominate the web3 space and continuously innovate the DeFi trading experience. We strive to be the world’s go-to crypto trading platforms, synonymous with innovation, community strength, and unparalleled market access."

"ORN is not just a digital asset; it's a passport to Orion's evolving ecosystem. As Orion embarks on its transformative journey, ORN holders are positioned to be at the forefront, ensuring they remain integral to Orion's future endeavors. Whether you're a referrer, a trader, or a liquidity node, the benefits of holding ORN are set to amplify over time."

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Orion Network Set Liability Vulnerability
!Date
!Event
!Description
|-
|May 27th, 2024 10:25:10 PM MDT
|Malicious Transaction
|The malicious transaction occurs on the Binance Smart chain.
|-
|May 27th, 2024 11:27:00 PM MDT
|SlowMist Tweet Posted
|SlowMist posts about the suspicious transaction. Of course, details on the transaction itself are not included.
|-
|May 28th, 2024 2:51:00 AM MDT
|ChainAegis Tweet
|ChainAegis tweets including the transaction link.
|-
|May 28th, 2024 8:29:00 AM MDT
|Nick L Franklin Analysis
|Twitter user Nick L Franklin posts an analysis of the root cause for the exploit.
|}

== Technical Details ==
"Root cause is that victim contract didn't manage liability correctly. "setLiability" must be called once per tokens. But there's another function that changes assetBalances, "requestReleaseStake". Using this function, hacker could" "call "setLiability" twice with ORN token. After that, he could withdraw much more tokens using this vulnerability."

== Total Amount Lost ==
$616 (SlowMist/ChainAegis) or $645 (Phalcon).

The total amount lost has been estimated at $616,000 USD.

== Immediate Reactions ==
"According to the SlowMist security team, the liquidity aggregator protocol Orion's contract was attacked, resulting in a loss of approximately $616,000."

"We detected potential suspicious activity related to @TradeOnOrion"

== Ultimate Outcome ==
"Dear developer, this is a white hat rescue hack. I wish no harm on your project and I appreciate what you're doing in defi world. Provide address to which I should transfer the assets back. Given the scale of the exploit, could we please consider a 10% bounty."

"Dear white hacker, thank you very much for the finding. Please return the funds back to the address. We agree to the bounty amount. Coule you please contact us by @truenico or email for further cooperation? Thank you!"

A bounty of $61,000 USD was paid for the discovery.

== Total Amount Recovered ==
The total amount recovered has been estimated at $555,000 USD.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="slowmisthackedarchive-14249">[https://web.archive.org/web/20240604181328/https://hacked.slowmist.io/ SlowMist Hacked - SlowMist Zone] (Jun 12, 2024)</ref>

<ref name="slowmistteamtwitter-14261">[https://twitter.com/SlowMist_Team/status/1795326102157816192 @SlowMist_Team Twitter] (Jun 13, 2024)</ref>

<ref name="oklink-14262">[https://www.oklink.com/bsc/address/0xe9d1d2a27458378dd6c6f0b2c390807aed2217ca BNB Chain Address 0xe9d1...2217ca | Blockchain Explorer | OKLink] (Jun 13, 2024)</ref>

<ref name="chainaegistwitter-14263">[https://twitter.com/ChainAegis/status/1795377395924615430 @ChainAegis Twitter] (Jun 13, 2024)</ref>

<ref name="bscscan-14264">[https://bscscan.com/tx/0x660837a1640dd9cc0561ab7ff6c85325edebfa17d8b11a3bb94457ba6dcae18c BNB Smart Chain Transaction Hash (Txhash) Details | BscScan] (Jun 13, 2024)</ref>

<ref name="0xnicklfranklintwitter-14265">[https://twitter.com/0xNickLFranklin/status/1795462447081652647 @0xNickLFranklin Twitter] (Jun 13, 2024)</ref>

<ref name="orion-14266">[https://orion.xyz/ Home - Orion] (Jun 13, 2024)</ref>

<ref name="oriondocs-14267">[https://docs.orion.xyz/ Mission & Vision | Orion – The CEXY DEX] (Jun 13, 2024)</ref>

<ref name="oriondocs-14268">[https://docs.orion.xyz/overview/token Token | Orion – The CEXY DEX] (Jun 13, 2024)</ref>

<ref name="phalconxyztwitter-14269">[https://twitter.com/Phalcon_xyz/status/1795355571391996333 @Phalcon_xyz Twitter] (Jun 13, 2024)</ref>

<ref name="phalconxyztwitter-14270">[https://twitter.com/Phalcon_xyz/status/1795355758235693089 @Phalcon_xyz Twitter] (Jun 13, 2024)</ref>

<ref name="cryptoevgentwitter-14271">[https://twitter.com/CryptoEvgen/status/1795416844800803184 @CryptoEvgen Twitter] (Jun 13, 2024)</ref>

<ref name="cryptoevgentwitter-14272">[https://twitter.com/CryptoEvgen/status/1795417392039809028 @CryptoEvgen Twitter] (Jun 13, 2024)</ref></references>

Orion Network Set Liability Vulnerability - Revision history