Sanshu Inu Deflation Flaw - Revision history

Azoundria at 18:26, 3 May 2023

2023-05-03T18:26:52Z

← Older revision		Revision as of 12:26, 3 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/sanshuinudeflationflaw.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/sanshuinudeflationflaw.php}}
	{{Unattributed Sources}}		{{Unattributed Sources}}

Line 6:		Line 6:
	One of the lead developers has intent to make all affected users whole again.		One of the lead developers has intent to make all affected users whole again.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="slowmisthacked-678" /><ref name="openblocksecgithub-2342" /><ref name="blocksecteammedium-2896" /><ref name="chainswap-2786" /><ref name="coinmarketcap-2897" /><ref name="sanshuinufinance-2898" /><ref name="arxiv-2899" /><ref name="etherscan-2900" /><ref name="blocksecteam-2901" /><ref name="etherscan-2902" /><ref name="etherscan-2903" /><ref name="sanshuinufinancearchive-2904" /><ref name="etherscan-2905" /><ref name="sanshutokentwitter-2906" /><ref name="sanshutokentwitter-2907" /><ref name="sanshutokentwitter-2908" /><ref name="sanshutokentwitter-2909" />
	<ref name="slowmisthacked-678" /><ref name="openblocksecgithub-2342" /><ref name="blocksecteammedium-2896" /><ref name="chainswap-2786" /><ref name="coinmarketcap-2897" /><ref name="sanshuinufinance-2898" /><ref name="arxiv-2899" /><ref name="etherscan-2900" /><ref name="blocksecteam-2901" /><ref name="etherscan-2902" /><ref name="etherscan-2903" /><ref name="sanshuinufinancearchive-2904" /><ref name="etherscan-2905" /><ref name="sanshutokentwitter-2906" /><ref name="sanshutokentwitter-2907" /><ref name="sanshutokentwitter-2908" /><ref name="sanshutokentwitter-2909" />

	== About Sanshu Inu ==		== About Sanshu Inu ==
Line 83:		Line 82:
	!Description		!Description
	\|-		\|-
	\|July 20th, 2021 ~~12:00:00 AM~~		\|July 20th, 2021
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 91:		Line 90:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 110:		Line 112:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
	== Prevention Policies ==
	While the smart contract security could be improved through additional audits and by offering bug bounties, this is yet another example to show that smart contract hot wallets may still contain vulnerabilities. It is not possible to prove that a sufficiently complex smart contract is completely secure.		While the smart contract security could be improved through additional audits and by offering bug bounties, this is yet another example to show that smart contract hot wallets may still contain vulnerabilities. It is not possible to prove that a sufficiently complex smart contract is completely secure.

	Storing the majority of funds in offline multi-signature storage is the best practice. The industry may also grow to develop a working smart contract insurance model. A project should generally be prepared for the full loss of anything stored in a smart contract hot wallet.		Storing the majority of funds in offline multi-signature storage is the best practice. The industry may also grow to develop a working smart contract insurance model. A project should generally be prepared for the full loss of anything stored in a smart contract hot wallet.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==

Azoundria at 03:53, 23 February 2023

2023-02-23T03:53:41Z

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/sanshuinudeflationflaw.php}} Sanshu InuSanshu Inu is a deflationary token operating exchangeable via a smart contract, which features a hot wallet liquidity pool. Despite a security audit being performed, there was still an error in the implementation of this pool which allowed an attacker to drain all the funds. One of the lead developers has intent to make all affec..."

2023-01-27T21:07:08Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/sanshuinudeflationflaw.php}} thumb|Sanshu InuSanshu Inu is a deflationary token operating exchangeable via a smart contract, which features a hot wallet liquidity pool. Despite a security audit being performed, there was still an error in the implementation of this pool which allowed an attacker to drain all the funds. One of the lead developers has intent to make all affec..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/sanshuinudeflationflaw.php}}

[[File:Sanshuinu.jpg|thumb|Sanshu Inu]]Sanshu Inu is a deflationary token operating exchangeable via a smart contract, which features a hot wallet liquidity pool. Despite a security audit being performed, there was still an error in the implementation of this pool which allowed an attacker to drain all the funds.

One of the lead developers has intent to make all affected users whole again.

This is a global/international case not involving a specific country.

== About Sanshu Inu ==
Sanshu Inu is "[a] community-focused decentralized transaction network. SANSHU is fully decentralized, and all decisions are made by the community." "Sanshu is fully decentralized, had a fair launch and an exciting roadmap."

"We are a part of the newly emerging Inu family! Thanks to the massive success of DOGE, several new spiritual successors have been released with inspiration from the classic memecoin itself! SANSHU is one of the newest of the bunch, and we have lots of unique features to offer!"

"A fully deflationary token that burns and redistributes tokens on every single transaction. $SANSHU’s deflationary mechanisms include a burn and redistribution system. 1% of each transaction is burned, and 1% is distributed as rewards to holders."

"We burnt 58%+ of the total token supply. Check for yourself on Etherscan. Don't trust, verify! You get what you deserve. 1% of each transaction is redistributed among the holders. We have made a fair launch and there are no team tokens. Luckily, no manipulation, no whales. Just the sound of a growing community. We aim to include the community in order to make decision for all. If the community has a benefit, we're happy. Together we grow. Undoubtly, we have a straight and delicious roadmap. While achieving those goals, we stay flexible and adapt to community suggestions."

“Currently, Sanshu Inu is a very small souvenir in relation to many other cryptos out there today. However, investors intrigued by the growth potential of such crypto options have perpetuated to pile into these names of late.”

"Here is a high quality crypto gem: Sanshu Inu which has just 400 holders at the moment. Very low Mktcap and should be skyrocket soon. Great roadmap!!!!!"

The "Smart Contracts [were] fully audited by techrate.org" in April 2021.

"On July 21st, [BlockSecTeam] reported a couple of suspicious transactions. After manual analysis, [they] confirm[ed] that th[o]se transactions are attacks to Sanshu Inu. Specifically, the Memstake contract of Sanshu Inu was attacked by abusing the deflation mechanism."

"Hello SANSHU ARMY, Yesterday evening around 8PM UTC DOGPARK has been attacked by what we believe has been a Reentrancy Attack." "All pending and future farming & staking rewards were drained from the DogPark MemeStake Contract and sold onto the open market by the attacker. All Keanu staked on the DogPark was exposed to this vulnerability, and this prevented Community Members from unstaking their tokens."

"Using the mechanism of deflation token KEANU to attack the reward vulnerabilities in the Memestake contract deployed by Sanshu Inu, the attacker finally made a profit of about 56 ETH."

"Step 1 (preparation): The attacker creates two attack contracts. The first one deposits 2,049B KEANU. The second one is the attack contract. Step 2 (manipulation): the attacker first borrows a large number of KEANU tokens using the flash loan ( Towards A First Step to Understand Flash Loan and Its Applications in DeFi Ecosystem (SBC 2021)) from uniswapV2, and then deposits the tokens into/withdraws from the Memestake using the second smart contract created in step 1. Since the KEANU has the deflation mechanism, which burns 2% tokens for each transaction, the real number of tokens deposited into the Memestake is smaller than the value ( user.amount) maintained by the Memestake contract. The attacker repeats this process and makes the number of KEANU tokens inside the Memestake decrease to a small one (1e-07). See the transaction 0x00ed and the following figure. Step 3 (making profit): The attacker invokes the Memestake.updatePool() to update the accMfundPerShare. This value relies on the number of KEANU tokens (which was manipulated in the second step.) Then the attacker obtains a large number of Mfund(~61M). See the transaction 0xa945 for more details. Step 4 (swapping to WETH): The attacker swaps the MFund and KEANU to WETH and launder the money through Tornado.Cash. The attacker gained 55.9484578158357 ETH as profits."

"The attack consists of four steps. The critical one is the second step, which leverages the deflation mechanism of the ERC20 token to manipulate the reward calculation of the Memstake smart contract."

"Farming & Staking has ended. No pending rewards are left to harvest. Distribution of MFUND has ended. 100M supply is now in circulation."

The "DEV Team is now looking into the next steps for MFUND rebase, due to this attack we might change a few things, but will be going forward as planned! We [a]ppreciate the trust the [c]ommunity has in the [t]eam and we will do everything in our power to restore things back to normal."

"Version 1.0 is scheduled for release soon, with a new smart contract developed from scratch! As well as a new Auditor that’s more trusted. The new reward token that will replace MFUND is our new governance token and you can use both MFUND & SANSHU to provide liquidity."

"The MemeStake Contract currently doesn’t contain any MFUND Tokens, this causes the issuance mechanism to fail. Because of this rewards you are seeing on DOGPARK are incorrect, if you were to withdraw yourself you would be withdrawn a zero wasting your eta on gas."

"We are currently working with a top Oracle provider to initiate the rebase which will be calculated from the total market cap of BTC, ADA, ETH & DOGE."

"At Sanshu, security for our community members is of the utmost importance. This is why we partnered with Solidity Finance to conduct a simulation of hundreds of thousands of interactions with our Smart Contract to determine if any security vulnerabilities existed. Solidity Finance’s audit results assured us that our smart contracts had passed the security test and so our Dev Team is now investigating how this attack could possibly have happened, since we had successfully passed a security audit."

"Our Main DEV SanshuBro will be compensating all who were affected by the exploit within the next 1–2 weeks." "SanshuBro will send the compensation based on the google form and send them the money by ERC20. Moreover, SanshuBro will cover the gas fees for sending these funds, just to show you how sorry the team is for this inconvenience."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Sanshu Inu Deflation Flaw
!Date
!Event
!Description
|-
|July 20th, 2021 12:00:00 AM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost has been estimated at $111,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
While the smart contract security could be improved through additional audits and by offering bug bounties, this is yet another example to show that smart contract hot wallets may still contain vulnerabilities. It is not possible to prove that a sufficiently complex smart contract is completely secure.

Storing the majority of funds in offline multi-signature storage is the best practice. The industry may also grow to develop a working smart contract insurance model. A project should generally be prepared for the full loss of anything stored in a smart contract hot wallet.

== References ==
[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17)

[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10)

[https://blocksecteam.medium.com/the-analysis-of-the-sanshu-inu-security-incident-28c0c7c0e783 The Analysis Of The Sanshu Inu Security Incident] (Aug 10)

[https://chainswap.com/ Chain Swap] (Aug 21)

[https://coinmarketcap.com/currencies/chainswap/ Chainswap price today, ASAP to USD live, marketcap and chart | CoinMarketCap] (Aug 21)

[https://sanshuinufinance.com/ SANSHU | A fully decentralized transaction network.] (Aug 30)

[https://arxiv.org/abs/2104.15068 <nowiki>[2104.15068] DeFiRanger: Detecting Price Manipulation Attacks on DeFi Applications</nowiki>] (Aug 30)

[https://etherscan.io/address/0x0333e323e61aa8afa38a1623604a165dcb9f4fec Address 0x0333e323e61aa8afa38a1623604a165dcb9f4fec | Etherscan] (Aug 30)

[https://www.blocksecteam.com/papers/sbc21_flashloan.pdf BlockSec Building BlockChain Security Infrastructure] (Aug 30)

[https://etherscan.io/token/0x106552c11272420aad5d7e94f8acab9095a6c952 $0.00 | Keanu Inu (KEANU) Token Tracker | Etherscan] (Aug 30)

[https://etherscan.io/address/0xe30dc9b3c29534e9b4e9a166c2f44411163ad59f Contract Address 0xe30dc9b3c29534e9b4e9a166c2f44411163ad59f | Etherscan] (Aug 30)

[https://web.archive.org/web/20210628135912/https://sanshuinufinance.com/audit.pdf SanshuInu Smart Contract Security Audit - TechRate] (Aug 30)

[https://etherscan.io/address/0xc73c167e7a4ba109e4052f70d5466d0c312a344d#code Sanshu Inu: SANSHU Token | 0xc73c167e7a4ba109e4052f70d5466d0c312a344d] (Aug 30)

[https://twitter.com/SanshuToken/status/1417831990070595585 @SanshuToken Twitter] (Aug 30)

[https://twitter.com/SanshuToken/status/1418242998844985350 @SanshuToken Twitter] (Aug 30)

[https://twitter.com/SanshuToken/status/1419693623059300352 @SanshuToken Twitter] (Aug 30)

[https://twitter.com/SanshuToken/status/1422289919083438084 @SanshuToken Twitter] (Aug 30)

← Older revision		Revision as of 21:53, 22 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/sanshuinudeflationflaw.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/sanshuinudeflationflaw.php}}
			{{Unattributed Sources}}

	[[File:Sanshuinu.jpg\|thumb\|Sanshu Inu]]Sanshu Inu is a deflationary token operating exchangeable via a smart contract, which features a hot wallet liquidity pool. Despite a security audit being performed, there was still an error in the implementation of this pool which allowed an attacker to drain all the funds.		[[File:Sanshuinu.jpg\|thumb\|Sanshu Inu]]Sanshu Inu is a deflationary token operating exchangeable via a smart contract, which features a hot wallet liquidity pool. Despite a security audit being performed, there was still an error in the implementation of this pool which allowed an attacker to drain all the funds.
Line 6:		Line 7:

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="slowmisthacked-678" /><ref name="openblocksecgithub-2342" /><ref name="blocksecteammedium-2896" /><ref name="chainswap-2786" /><ref name="coinmarketcap-2897" /><ref name="sanshuinufinance-2898" /><ref name="arxiv-2899" /><ref name="etherscan-2900" /><ref name="blocksecteam-2901" /><ref name="etherscan-2902" /><ref name="etherscan-2903" /><ref name="sanshuinufinancearchive-2904" /><ref name="etherscan-2905" /><ref name="sanshutokentwitter-2906" /><ref name="sanshutokentwitter-2907" /><ref name="sanshutokentwitter-2908" /><ref name="sanshutokentwitter-2909" />

	== About Sanshu Inu ==		== About Sanshu Inu ==
Line 115:		Line 117:

	== References ==		== References ==
	[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17)		<references><ref name="slowmisthacked-678">[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 18, 2021)</ref>

	[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10)		<ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 11, 2021)</ref>

	[https://blocksecteam.medium.com/the-analysis-of-the-sanshu-inu-security-incident-28c0c7c0e783 The Analysis Of The Sanshu Inu Security Incident] (Aug 10)		<ref name="blocksecteammedium-2896">[https://blocksecteam.medium.com/the-analysis-of-the-sanshu-inu-security-incident-28c0c7c0e783 The Analysis Of The Sanshu Inu Security Incident] (Aug 11, 2021)</ref>

	[https://chainswap.com/ Chain Swap] (Aug 21)		<ref name="chainswap-2786">[https://chainswap.com/ Chain Swap] (Aug 22, 2021)</ref>

	[https://coinmarketcap.com/currencies/chainswap/ Chainswap price today, ASAP to USD live, marketcap and chart \| CoinMarketCap] (Aug 21)		<ref name="coinmarketcap-2897">[https://coinmarketcap.com/currencies/chainswap/ Chainswap price today, ASAP to USD live, marketcap and chart \| CoinMarketCap] (Aug 22, 2021)</ref>

	[https://sanshuinufinance.com/ SANSHU \| A fully decentralized transaction network.] (Aug 30)		<ref name="sanshuinufinance-2898">[https://sanshuinufinance.com/ SANSHU \| A fully decentralized transaction network.] (Aug 31, 2021)</ref>

	[https://arxiv.org/abs/2104.15068 <nowiki>[2104.15068] DeFiRanger: Detecting Price Manipulation Attacks on DeFi Applications</nowiki>] (Aug 30)		<ref name="arxiv-2899">[https://arxiv.org/abs/2104.15068 <nowiki>[2104.15068] DeFiRanger: Detecting Price Manipulation Attacks on DeFi Applications</nowiki>] (Aug 31, 2021)</ref>

	[https://etherscan.io/address/0x0333e323e61aa8afa38a1623604a165dcb9f4fec Address 0x0333e323e61aa8afa38a1623604a165dcb9f4fec \| Etherscan] (Aug 30)		<ref name="etherscan-2900">[https://etherscan.io/address/0x0333e323e61aa8afa38a1623604a165dcb9f4fec Address 0x0333e323e61aa8afa38a1623604a165dcb9f4fec \| Etherscan] (Aug 31, 2021)</ref>

	[https://www.blocksecteam.com/papers/sbc21_flashloan.pdf BlockSec Building BlockChain Security Infrastructure] (Aug 30)		<ref name="blocksecteam-2901">[https://www.blocksecteam.com/papers/sbc21_flashloan.pdf BlockSec Building BlockChain Security Infrastructure] (Aug 31, 2021)</ref>

	[https://etherscan.io/token/0x106552c11272420aad5d7e94f8acab9095a6c952 $0.00 \| Keanu Inu (KEANU) Token Tracker \| Etherscan] (Aug 30)		<ref name="etherscan-2902">[https://etherscan.io/token/0x106552c11272420aad5d7e94f8acab9095a6c952 $0.00 \| Keanu Inu (KEANU) Token Tracker \| Etherscan] (Aug 31, 2021)</ref>

	[https://etherscan.io/address/0xe30dc9b3c29534e9b4e9a166c2f44411163ad59f Contract Address 0xe30dc9b3c29534e9b4e9a166c2f44411163ad59f \| Etherscan] (Aug 30)		<ref name="etherscan-2903">[https://etherscan.io/address/0xe30dc9b3c29534e9b4e9a166c2f44411163ad59f Contract Address 0xe30dc9b3c29534e9b4e9a166c2f44411163ad59f \| Etherscan] (Aug 31, 2021)</ref>

	[https://web.archive.org/web/20210628135912/https://sanshuinufinance.com/audit.pdf SanshuInu Smart Contract Security Audit - TechRate] (Aug 30)		<ref name="sanshuinufinancearchive-2904">[https://web.archive.org/web/20210628135912/https://sanshuinufinance.com/audit.pdf SanshuInu Smart Contract Security Audit - TechRate] (Aug 31, 2021)</ref>

	[https://etherscan.io/address/0xc73c167e7a4ba109e4052f70d5466d0c312a344d#code Sanshu Inu: SANSHU Token \| 0xc73c167e7a4ba109e4052f70d5466d0c312a344d] (Aug 30)		<ref name="etherscan-2905">[https://etherscan.io/address/0xc73c167e7a4ba109e4052f70d5466d0c312a344d#code Sanshu Inu: SANSHU Token \| 0xc73c167e7a4ba109e4052f70d5466d0c312a344d] (Aug 31, 2021)</ref>

	[https://twitter.com/SanshuToken/status/1417831990070595585 @SanshuToken Twitter] (Aug 30)		<ref name="sanshutokentwitter-2906">[https://twitter.com/SanshuToken/status/1417831990070595585 @SanshuToken Twitter] (Aug 31, 2021)</ref>

	[https://twitter.com/SanshuToken/status/1418242998844985350 @SanshuToken Twitter] (Aug 30)		<ref name="sanshutokentwitter-2907">[https://twitter.com/SanshuToken/status/1418242998844985350 @SanshuToken Twitter] (Aug 31, 2021)</ref>

	[https://twitter.com/SanshuToken/status/1419693623059300352 @SanshuToken Twitter] (Aug 30)		<ref name="sanshutokentwitter-2908">[https://twitter.com/SanshuToken/status/1419693623059300352 @SanshuToken Twitter] (Aug 31, 2021)</ref>

	[https://twitter.com/SanshuToken/status/1422289919083438084 @SanshuToken Twitter] (Aug 30)		<ref name="sanshutokentwitter-2909">[https://twitter.com/SanshuToken/status/1422289919083438084 @SanshuToken Twitter] (Aug 31, 2021)</ref></references>