Soda Finance Loophole - Revision history

Azoundria at 17:53, 2 May 2023

2023-05-02T17:53:20Z

← Older revision		Revision as of 11:53, 2 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/sodafinanceloophole.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/sodafinanceloophole.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Sodafinance.jpg\|thumb\|Soda Finance]]Soda Finance is a yield farming project run by an anonymous team. There was a loophole in the smart contract, which was ignored by the team. The loophole was exploited. The team partially compensated affected users. The project is still running.		[[File:Sodafinance.jpg\|thumb\|Soda Finance]]Soda Finance is a yield farming project run by an anonymous team. There was a loophole in the smart contract, which was ignored by the team. The loophole was exploited. The team partially compensated affected users. The project is still running.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="slowmisthacked-678" /><ref name="sodafinance-1838" /><ref name="sodafinancemedium-1839" /><ref name="sodafinancemedium-1840" /><ref name="sodafinancetwitter-1841" /><ref name="sodafinancetwitter-1842" /><ref name="sodafinancetwitter-1843" /><ref name="sodafinancetwitter-1844" /><ref name="sodafinancetwitter-1845" /><ref name="sodafinancegithub-1846" /><ref name="sodafinancemedium-1847" /><ref name="certik-1776" />
	<ref name="slowmisthacked-678" /><ref name="sodafinance-1838" /><ref name="sodafinancemedium-1839" /><ref name="sodafinancemedium-1840" /><ref name="sodafinancetwitter-1841" /><ref name="sodafinancetwitter-1842" /><ref name="sodafinancetwitter-1843" /><ref name="sodafinancetwitter-1844" /><ref name="sodafinancetwitter-1845" /><ref name="sodafinancegithub-1846" /><ref name="sodafinancemedium-1847" /><ref name="certik-1776" />

	== About Soda Finance ==		== About Soda Finance ==
Line 61:		Line 60:
	!Description		!Description
	\|-		\|-
	\|September 22nd, 2020 ~~12:00:00 AM~~		\|September 22nd, 2020
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 69:		Line 68:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 88:		Line 90:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
	== Prevention Policies ==
	Having the majority of exchange funds (aka liquidity pool) in a hot wallet (aka smart contract) is never a good idea. However, in the DeFi space, this is the common practice. Having the majority of the liquidity in a cold storage multi-sig would have prevented it being lost due to the exploit.		Having the majority of exchange funds (aka liquidity pool) in a hot wallet (aka smart contract) is never a good idea. However, in the DeFi space, this is the common practice. Having the majority of the liquidity in a cold storage multi-sig would have prevented it being lost due to the exploit.

	Having the large scale project run by an anonymous team is never a good idea in case things go wrong with the enormously complex code. Luckily in this case, the team appears not to have malicious intent and had some interest in assisting affected users.		Having the large scale project run by an anonymous team is never a good idea in case things go wrong with the enormously complex code. Luckily in this case, the team appears not to have malicious intent and had some interest in assisting affected users.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	<references><ref name="slowmisthacked-678">[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17, 2021)</ref>		<references><ref name="slowmisthacked-678">[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 18, 2021)</ref>

	<ref name="sodafinance-1838">[https://soda.finance/ Soda] (Jul 25, 2021)</ref>		<ref name="sodafinance-1838">[https://soda.finance/ Soda] (Jul 26, 2021)</ref>

	<ref name="sodafinancemedium-1839">[https://medium.com/soda-finance/soda-v2-do-you-like-this-proposal-9572cad04a59 Soda V2 Do You Like This Proposal] (Jul 25, 2021)</ref>		<ref name="sodafinancemedium-1839">[https://medium.com/soda-finance/soda-v2-do-you-like-this-proposal-9572cad04a59 Soda V2 Do You Like This Proposal] (Jul 26, 2021)</ref>

	<ref name="sodafinancemedium-1840">[https://medium.com/soda-finance/soda-lovers-lets-move-forward-ce02dea8a0f Soda Lovers Lets Move Forward] (Jul 25, 2021)</ref>		<ref name="sodafinancemedium-1840">[https://medium.com/soda-finance/soda-lovers-lets-move-forward-ce02dea8a0f Soda Lovers Lets Move Forward] (Jul 26, 2021)</ref>

	<ref name="sodafinancetwitter-1841">[https://twitter.com/Soda_finance/status/1312771934459850752 @Soda_finance Twitter] (Jul 25, 2021)</ref>		<ref name="sodafinancetwitter-1841">[https://twitter.com/Soda_finance/status/1312771934459850752 @Soda_finance Twitter] (Jul 26, 2021)</ref>

	<ref name="sodafinancetwitter-1842">[https://twitter.com/Soda_finance/status/1308813166869016577 @Soda_finance Twitter] (Jul 25, 2021)</ref>		<ref name="sodafinancetwitter-1842">[https://twitter.com/Soda_finance/status/1308813166869016577 @Soda_finance Twitter] (Jul 26, 2021)</ref>

	<ref name="sodafinancetwitter-1843">[https://twitter.com/Soda_finance/status/1308541909363601410 @Soda_finance Twitter] (Jul 25, 2021)</ref>		<ref name="sodafinancetwitter-1843">[https://twitter.com/Soda_finance/status/1308541909363601410 @Soda_finance Twitter] (Jul 26, 2021)</ref>

	<ref name="sodafinancetwitter-1844">[https://twitter.com/Soda_finance/status/1308539897246965761 @Soda_finance Twitter] (Jul 25, 2021)</ref>		<ref name="sodafinancetwitter-1844">[https://twitter.com/Soda_finance/status/1308539897246965761 @Soda_finance Twitter] (Jul 26, 2021)</ref>

	<ref name="sodafinancetwitter-1845">[https://twitter.com/Soda_finance/status/1307788252640927745 @Soda_finance Twitter] (Jul 25, 2021)</ref>		<ref name="sodafinancetwitter-1845">[https://twitter.com/Soda_finance/status/1307788252640927745 @Soda_finance Twitter] (Jul 26, 2021)</ref>

	<ref name="sodafinancegithub-1846">[https://github.com/soda-finance/soda-contracts/blob/master/contracts/calculators/WETHCalculatorFixed.sol soda-contracts/WETHCalculatorFixed.sol at master · soda-finance/soda-contracts · GitHub] (Jul 25, 2021)</ref>		<ref name="sodafinancegithub-1846">[https://github.com/soda-finance/soda-contracts/blob/master/contracts/calculators/WETHCalculatorFixed.sol soda-contracts/WETHCalculatorFixed.sol at master · soda-finance/soda-contracts · GitHub] (Jul 26, 2021)</ref>

	<ref name="sodafinancemedium-1847">[https://medium.com/soda-finance/the-soda-revolution-9185fdb99fc1 The Soda Revolution] (Jul 25, 2021)</ref>		<ref name="sodafinancemedium-1847">[https://medium.com/soda-finance/the-soda-revolution-9185fdb99fc1 The Soda Revolution] (Jul 26, 2021)</ref>

	<ref name="certik-1776">[https://www.certik.org/blog/blockchain-hacks-2020-15-billion-lost-how-can-we-mitigate-hacks-in-2021 Blockchain Hacks: 2020 \| $15 billion lost, how can we mitigate hacks in 2021? \| CertiK Foundation Blog] (Jul 22, 2021)</ref></references>		<ref name="certik-1776">[https://www.certik.org/blog/blockchain-hacks-2020-15-billion-lost-how-can-we-mitigate-hacks-in-2021 Blockchain Hacks: 2020 \| $15 billion lost, how can we mitigate hacks in 2021? \| CertiK Foundation Blog] (Jul 23, 2021)</ref></references>

Azoundria at 17:23, 17 February 2023

2023-02-17T17:23:27Z

← Older revision		Revision as of 11:23, 17 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/sodafinanceloophole.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/sodafinanceloophole.php}}
			{{Unattributed Citations}}

	[[File:Sodafinance.jpg\|thumb\|Soda Finance]]Soda Finance is a yield farming project run by an anonymous team. There was a loophole in the smart contract, which was ignored by the team. The loophole was exploited. The team partially compensated affected users. The project is still running.		[[File:Sodafinance.jpg\|thumb\|Soda Finance]]Soda Finance is a yield farming project run by an anonymous team. There was a loophole in the smart contract, which was ignored by the team. The loophole was exploited. The team partially compensated affected users. The project is still running.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="slowmisthacked-678" /><ref name="sodafinance-1838" /><ref name="sodafinancemedium-1839" /><ref name="sodafinancemedium-1840" /><ref name="sodafinancetwitter-1841" /><ref name="sodafinancetwitter-1842" /><ref name="sodafinancetwitter-1843" /><ref name="sodafinancetwitter-1844" /><ref name="sodafinancetwitter-1845" /><ref name="sodafinancegithub-1846" /><ref name="sodafinancemedium-1847" /><ref name="certik-1776" />

	== About Soda Finance ==		== About Soda Finance ==
Line 39:		Line 41:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 61:		Line 62:
	\|-		\|-
	\|September 22nd, 2020 12:00:00 AM		\|September 22nd, 2020 12:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 74:		Line 71:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $159,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 85:		Line 82:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 98:		Line 95:

	== References ==		== References ==
	[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17)		<references><ref name="slowmisthacked-678">[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17, 2021)</ref>

	[https://soda.finance/ Soda] (Jul 25)		<ref name="sodafinance-1838">[https://soda.finance/ Soda] (Jul 25, 2021)</ref>

	[https://medium.com/soda-finance/soda-v2-do-you-like-this-proposal-9572cad04a59 Soda V2 Do You Like This Proposal] (Jul 25)		<ref name="sodafinancemedium-1839">[https://medium.com/soda-finance/soda-v2-do-you-like-this-proposal-9572cad04a59 Soda V2 Do You Like This Proposal] (Jul 25, 2021)</ref>

	[https://medium.com/soda-finance/soda-lovers-lets-move-forward-ce02dea8a0f Soda Lovers Lets Move Forward] (Jul 25)		<ref name="sodafinancemedium-1840">[https://medium.com/soda-finance/soda-lovers-lets-move-forward-ce02dea8a0f Soda Lovers Lets Move Forward] (Jul 25, 2021)</ref>

	[https://twitter.com/Soda_finance/status/1312771934459850752 @Soda_finance Twitter] (Jul 25)		<ref name="sodafinancetwitter-1841">[https://twitter.com/Soda_finance/status/1312771934459850752 @Soda_finance Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/Soda_finance/status/1308813166869016577 @Soda_finance Twitter] (Jul 25)		<ref name="sodafinancetwitter-1842">[https://twitter.com/Soda_finance/status/1308813166869016577 @Soda_finance Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/Soda_finance/status/1308541909363601410 @Soda_finance Twitter] (Jul 25)		<ref name="sodafinancetwitter-1843">[https://twitter.com/Soda_finance/status/1308541909363601410 @Soda_finance Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/Soda_finance/status/1308539897246965761 @Soda_finance Twitter] (Jul 25)		<ref name="sodafinancetwitter-1844">[https://twitter.com/Soda_finance/status/1308539897246965761 @Soda_finance Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/Soda_finance/status/1307788252640927745 @Soda_finance Twitter] (Jul 25)		<ref name="sodafinancetwitter-1845">[https://twitter.com/Soda_finance/status/1307788252640927745 @Soda_finance Twitter] (Jul 25, 2021)</ref>

	[https://github.com/soda-finance/soda-contracts/blob/master/contracts/calculators/WETHCalculatorFixed.sol soda-contracts/WETHCalculatorFixed.sol at master · soda-finance/soda-contracts · GitHub] (Jul 25)		<ref name="sodafinancegithub-1846">[https://github.com/soda-finance/soda-contracts/blob/master/contracts/calculators/WETHCalculatorFixed.sol soda-contracts/WETHCalculatorFixed.sol at master · soda-finance/soda-contracts · GitHub] (Jul 25, 2021)</ref>

	[https://medium.com/soda-finance/the-soda-revolution-9185fdb99fc1 The Soda Revolution] (Jul 25)		<ref name="sodafinancemedium-1847">[https://medium.com/soda-finance/the-soda-revolution-9185fdb99fc1 The Soda Revolution] (Jul 25, 2021)</ref>

	[https://www.certik.org/blog/blockchain-hacks-2020-15-billion-lost-how-can-we-mitigate-hacks-in-2021 Blockchain Hacks: 2020 \| $15 billion lost, how can we mitigate hacks in 2021? \| CertiK Foundation Blog] (Jul 22)		<ref name="certik-1776">[https://www.certik.org/blog/blockchain-hacks-2020-15-billion-lost-how-can-we-mitigate-hacks-in-2021 Blockchain Hacks: 2020 \| $15 billion lost, how can we mitigate hacks in 2021? \| CertiK Foundation Blog] (Jul 22, 2021)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/sodafinanceloophole.php}} Soda FinanceSoda Finance is a yield farming project run by an anonymous team. There was a loophole in the smart contract, which was ignored by the team. The loophole was exploited. The team partially compensated affected users. The project is still running. This is a global/international case not involving a specific country. == About Soda..."

2023-01-25T18:26:26Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/sodafinanceloophole.php}} thumb|Soda FinanceSoda Finance is a yield farming project run by an anonymous team. There was a loophole in the smart contract, which was ignored by the team. The loophole was exploited. The team partially compensated affected users. The project is still running. This is a global/international case not involving a specific country. == About Soda..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/sodafinanceloophole.php}}

[[File:Sodafinance.jpg|thumb|Soda Finance]]Soda Finance is a yield farming project run by an anonymous team. There was a loophole in the smart contract, which was ignored by the team. The loophole was exploited. The team partially compensated affected users. The project is still running.

This is a global/international case not involving a specific country.

== About Soda Finance ==
"SODA is the next generation of DeFi that will take Yield Farming to where it has never gone before! Strap in and get a straw — this is gonna be soooooo good!" "Ready to be impressed? SODA uses novel dual token economics(SODA and SoETH), and this means that anyone can deposit Wrapped Ethereum (WETH) along with other assets to earn SODA. In return, you can choose to borrow SoETH from the protocol and use SoETH to earn even more SODA."

"SODA is not another yield farming project. The long term goal of SODA is to provide more liquidity and valuable financial services to the Ethereum ecosystem. The current goal is to generate more collateral backed assets from SODA borrowing."

"Our SODA-ETH staking pool has a 5x multiplier & is currently paying out a astounding 4185% APY!"

"The financial blogger "Super Bitcoin" stated on Weibo that Mr. Huai (weibo username "crash X") participated in the liquidity mining project Soda, and suddenly discovered a loophole in which 20,000 ETH can be directly liquidated Drop. But he chose to tell the development team, but the development team did not pay attention. He had no choice but to liquidate an ETH, and sent a Weibo warning to inform the developers of the existence of this bug. One hour later, the parties to the Soda agreement responded by prompting the borrower to repay and the mortgager to withdraw, and at the same time indicated that they would fix the loopholes and suspend the front-end borrowing function. But as of the early morning of September 21st, more than 400 ETH in Soda's mortgage loan pool were still maliciously liquidated. In the morning of the same day, the agreement officially stated on Twitter that the vulnerability has been fixed, and the newly deployed smart contract is expected to take effect at 21:00 on September 22."

"Again, yield farming is a highly risky game. We understand that the SODA token’s price went down a lot, but everything happened was purely due to the supply and demand of the market. Don’t participate in anything that is beyond your risk tolerance."

"We thank you for your patience while we patch and deploy a fix for the bug. Looking back over the past 48 hours, we have done our best to reduce the asset loss. We tracked all the on-chain data and counted the total loss. In total, we found 17 addresses that were affected by this bug, of which 12 addresses totaling 448.339 WETH principal were liquidated by hackers. The actual loss to the victims is 134.5017 WETH which is 30% of the principal."

"We are willing to compensate the remaining 30% of original locked WETH in the form of SoETH from our SodaDev Pool. For example, if you locked 100 WETH, borrowed 70 SoETH, and lost your locked principal, we will send you 30 SoETH as compensation."

"The community is voicing their desire for a security audit and we hear you! We are preparing for a full audit to validate the code and give more trust to the community."

"We're happy to announce that the patch for the bug fix has been deployed and activated. All features are once again live!" "In Soda V2, there will be no more yield farming. However, we will provide different investment strategies though our vaults."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Soda Finance Loophole
!Date
!Event
!Description
|-
|September 22nd, 2020 12:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Having the majority of exchange funds (aka liquidity pool) in a hot wallet (aka smart contract) is never a good idea. However, in the DeFi space, this is the common practice. Having the majority of the liquidity in a cold storage multi-sig would have prevented it being lost due to the exploit.

Having the large scale project run by an anonymous team is never a good idea in case things go wrong with the enormously complex code. Luckily in this case, the team appears not to have malicious intent and had some interest in assisting affected users.

== References ==
[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17)

[https://soda.finance/ Soda] (Jul 25)

[https://medium.com/soda-finance/soda-v2-do-you-like-this-proposal-9572cad04a59 Soda V2 Do You Like This Proposal] (Jul 25)

[https://medium.com/soda-finance/soda-lovers-lets-move-forward-ce02dea8a0f Soda Lovers Lets Move Forward] (Jul 25)

[https://twitter.com/Soda_finance/status/1312771934459850752 @Soda_finance Twitter] (Jul 25)

[https://twitter.com/Soda_finance/status/1308813166869016577 @Soda_finance Twitter] (Jul 25)

[https://twitter.com/Soda_finance/status/1308541909363601410 @Soda_finance Twitter] (Jul 25)

[https://twitter.com/Soda_finance/status/1308539897246965761 @Soda_finance Twitter] (Jul 25)

[https://twitter.com/Soda_finance/status/1307788252640927745 @Soda_finance Twitter] (Jul 25)

[https://github.com/soda-finance/soda-contracts/blob/master/contracts/calculators/WETHCalculatorFixed.sol soda-contracts/WETHCalculatorFixed.sol at master · soda-finance/soda-contracts · GitHub] (Jul 25)

[https://medium.com/soda-finance/the-soda-revolution-9185fdb99fc1 The Soda Revolution] (Jul 25)

[https://www.certik.org/blog/blockchain-hacks-2020-15-billion-lost-how-can-we-mitigate-hacks-in-2021 Blockchain Hacks: 2020 | $15 billion lost, how can we mitigate hacks in 2021? | CertiK Foundation Blog] (Jul 22)