Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/pikefinanceusdcwithdrawalvulnerability.php}} {{Unattributed Sources}} Pike Finance Logo/HomepagePike Finance is a loan protocol which allows loans to be taken out using collateral on other chains. As part of their deployment, there was a known and identified issue where USDC can be withdrawn without proper validation. The team corrected the vulnerability w..."

2024-05-07T00:04:52Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/pikefinanceusdcwithdrawalvulnerability.php}} {{Unattributed Sources}} thumb|Pike Finance Logo/HomepagePike Finance is a loan protocol which allows loans to be taken out using collateral on other chains. As part of their deployment, there was a known and identified issue where USDC can be withdrawn without proper validation. The team corrected the vulnerability w..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/pikefinanceusdcwithdrawalvulnerability.php}}
{{Unattributed Sources}}

[[File:Pikefinance.jpg|thumb|Pike Finance Logo/Homepage]]Pike Finance is a loan protocol which allows loans to be taken out using collateral on other chains. As part of their deployment, there was a known and identified issue where USDC can be withdrawn without proper validation. The team corrected the vulnerability with an upgrade which allowed all the assets to be drained from their smart contract, then eventually offered refunds to users.<ref name="rekthqtwitter-13600" /><ref name="rektnews-13601" /><ref name="pikefinancetwitter-13602" /><ref name="pikefinance-13603" /><ref name="pikefinancedocs-13604" /><ref name="mirror-13605" /><ref name="mirror-13606" /><ref name="optimistic-13607" /><ref name="zapper-13608" /><ref name="etherscan-13609" /><ref name="etherscan-13610" /><ref name="basescan-13611" />

== About Pike Finance ==
"Universal Liquidity Protocol A next generation money market 一 deposit collateral on chain A, borrow on chain B."

"Pike is a universal liquidity market optimized for native assets." "Pike is a universal liquidity market that enables lending and borrowing using native assets directly on their respective blockchains, eliminating the need for wrapping and cross-chain transfers."

"Pike enables lending and borrowing using native assets directly on their respective blockchains, eliminating the need for wrapping and cross-chain transfers. For example, users can deposit Arbitrum's ARB tokens as collateral on their native Arbitrum chain, while borrowing other assets on a different blockchain." "Pike is enabled by Wormhole Cross-Chain Messaging, Circle’s Cross-Chain Transfer Protocol, and Pyth Data Feeds."

"Pike redefines the user experience for cross-chain lending and borrowing - Our focus on native assets remove the need for assets with suffixes and prefixes." "Seamlessly maximize your yields and leverage Pike’s native cross-chain functionality 一 No longer do you have to constantly bridge your assets to explore opportunities across the ecosystem." "Pike’s hub and spoke architecture is designed to fade into the background 一 Allowing users to realize an interconnected DeFi vision. Utilize a suite of assets from across the ecosystem 一 Ranging from yield bearing stablecoins and LSTs, to LP tokens."

"Wormhole messaging eliminates risks associated with cross-chain bridges and bridged assets 一 reducing attack vectors stemming from pricing oracles."

== The Reality ==
The smart contract had a vulnerability which was reported and ignored, allowing the theft of $299k wroth of USDC.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Pike Finance USDC Withdrawal Vulnerability
!Date
!Event
!Description
|-
|April 25th, 2024 5:32:35 PM MDT
|Binance Funding Source
|Attacker is initially funded from Binance with 0.11487 ETH on the Optimism chain.
|-
|April 25th, 2024 6:13:59 PM MDT
|Exploit Timestamp
|The USDC withdrawal exploit is first exploited, withdrawing $162,537 USDC.
|-
|April 25th, 2024 6:32:35 PM MDT
|Bridge To Ethereum
|Assets are bridged back to the ethereum blockchain.
|-
|April 25th, 2024 7:34:59 PM MDT
|First TornadoCash Deposit
|The attacker deposits the first batch of 10 ETH into TornadoCash.
|-
|April 26th, 2024 11:59:35 AM MDT
|Team Reaching Out
|The Pike Finance team reaches out to the attacker requesting to "resolve this matter in a mutually beneficial way". There is no response to their request.
|-
|May 1st, 2024 10:30:00 AM MDT
|Announcement By Pike Finance
|Pike Finance announces to clarify their language of the exploit, ensuring it's clear that their protocol, and not USDC, was vulnerable.
|-
|May 2nd, 2024 5:07:49 AM MDT
|Path Forward Published
|Pike Finance publishes a path forward for both vulnerabilities and how they plan to compensate users.
|}

== Technical Details ==
Attacker:
0xAdaF1626aEC26A7937aE7d1Fa0664e6E0904C1d0

Target Contract: 0x7856493B59cdb1685757A6DcCe12425F6a6666a0

Attack Transaction:
0x979ad9b7f5331ea8034305a83b5cd50aea88adec395fff8298dd90eb1b87667f

== Total Amount Lost ==
"On the 30th of April 2024, the Pike Beta protocol was exploited for 99,970.48 ARB, 64,126 OP and 479.39 ETH."

The total amount lost has been estimated at $299,000 USD.

== Immediate Reactions ==
"While we continue our investigation, we are offering a 20% reward for the return of the funds, or information leading to the recovery of funds."

== Ultimate Outcome ==
Ongoing.

== Total Amount Recovered ==
The Pike Finance team published a blog post with the plan forward.

"In the coming days, we will disclose a full list of wallet addresses with active supply and borrow positions prior to the protocol halt as of April 26 08:35 PM UTC. Addresses with a supply position will have a credit balance, and addresses with a borrow position will have a debit balance. We will calculate the Net Balance [Total Value of Supply - Total Value of Borrow] and assess whether liquidation levels have been triggered using asset prices as of April 26 08:35 PM UTC. Addresses with a positive net balance after accounting for liquidation checks will be restituted in full directly to their wallets ($OP via Optimism, $ARB via Arbitrum, $ETH and $USDC via Base)."

"The Community Treasury allocation of $P has been set aside for various usages, however one of these is of course, as an insurance fund.

As a result, we will be using 4% of the total supply of $P (from the Community Treasury allocation) as collateral to borrow the necessary stablecoin funds from the team treasury (around $2M USD across both exploits).

These will then be used to purchase the relevant assets on the open market and reimburse users for what they had within Pike prior to the exploit.

As the protocol generates revenue and launches the $P token, this loan will then be paid back accordingly - transferring the $P tokens used as collateral to the Foundation Treasury.

Once the debt is repaid, the $P will be released back to Insurance pool"

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
Refunds.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rekthqtwitter-13600">[https://twitter.com/RektHQ/status/1787169917684625878 @RektHQ Twitter] (May 6, 2024)</ref>

<ref name="rektnews-13601">[https://rekt.news/pike-rekt/ Rekt - Pike Finance - Rekt] (May 6, 2024)</ref>

<ref name="pikefinancetwitter-13602">[https://twitter.com/PikeFinance/status/1785708269258019074 @PikeFinance Twitter] (May 6, 2024)</ref>

<ref name="pikefinance-13603">[https://www.pike.finance/ Pike | Universal Liquidity Protocol] (May 6, 2024)</ref>

<ref name="pikefinancedocs-13604">[https://docs.pike.finance/ Introduction to Pike | User Docs | Pike] (May 6, 2024)</ref>

<ref name="mirror-13605">[https://mirror.xyz/pikefinance.eth/klLV4rRqNYxjRQp0NAfVLboLYtX98P9iYOOf06FUapg Pike: A Path Forward — Pike] (May 6, 2024)</ref>

<ref name="mirror-13606">[https://mirror.xyz/pikefinance.eth/M1ToE42vwEHuE6xlz0dVRQwPT0xpaRtpIIw2arOdBAM Post-Mortem Report: Pike USDC Withdrawal Vulnerability — Pike] (May 6, 2024)</ref>

<ref name="optimistic-13607">[https://optimistic.etherscan.io/tx/0xb5787b2f1238bd3d083034e7c3d59ffe7059fc420afd3a281241dcd148326bd1 OP Mainnet Transaction Hash (Txhash) Details | OP Mainnet Etherscan] (May 6, 2024)</ref>

<ref name="zapper-13608">[https://zapper.xyz/account/0xadaf1626aec26a7937ae7d1fa0664e6e0904c1d0?tab=history https://zapper.xyz/account/0xadaf1626aec26a7937ae7d1fa0664e6e0904c1d0?tab=history] (May 6, 2024)</ref>

<ref name="etherscan-13609">[https://etherscan.io/tx/0x083ce2d1767f8c4a7696bb31d04bc8d7faf209192ee20fd7fe1848783b659a7a Ethereum Transaction Hash (Txhash) Details | Etherscan] (May 6, 2024)</ref>

<ref name="etherscan-13610">[https://etherscan.io/tx/0xd17bbba5c906f41351ca0032af74efa09c7e97c14c9f40e44c38f1349ffc7ea7 Ethereum Transaction Hash (Txhash) Details | Etherscan] (May 6, 2024)</ref>

<ref name="basescan-13611">[https://basescan.org/tx/0x7bfee1f5033c5b84b11a778b2a8cb53c1c7358c8bb1bb7142ab4e8b88ecb392e BaseScan Transaction Hash (Txhash) Details | Base] (May 6, 2024)</ref></references>

Pike Finance USDC Withdrawal Vulnerability - Revision history