Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/thalalabsv1farmingcontractvulnerability.php}} {{Unattributed Sources}} Thala Labs Logo/HomepageThala Labs forms a backbone of the Aptos blockchain, offering liquidity, staking, swapping, and a stablecoin for the ecosystem. On November 15th, 2024, the protocol was successfully attacked and drained for $25.5m USD worth of funds. The protocol managed to iden..."

2024-12-20T23:01:14Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/thalalabsv1farmingcontractvulnerability.php}} {{Unattributed Sources}} thumb|Thala Labs Logo/HomepageThala Labs forms a backbone of the Aptos blockchain, offering liquidity, staking, swapping, and a stablecoin for the ecosystem. On November 15th, 2024, the protocol was successfully attacked and drained for $25.5m USD worth of funds. The protocol managed to iden..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/thalalabsv1farmingcontractvulnerability.php}}
{{Unattributed Sources}}

[[File:Thalafinance.jpg|thumb|Thala Labs Logo/Homepage]]Thala Labs forms a backbone of the Aptos blockchain, offering liquidity, staking, swapping, and a stablecoin for the ecosystem. On November 15th, 2024, the protocol was successfully attacked and drained for $25.5m USD worth of funds. The protocol managed to identify the hackers and obtained a return of all funds except for a $300k bounty. They relaunched their application with all assets backed and will bring staking/unstaking back online following a proper security audit.<ref name="thalalabstwitter-17036" /><ref name="thalafi-17037" /><ref name="thalafidocs-17038" /><ref name="thalalabstwitter-17039" /><ref name="halborn-17040" /><ref name="quillaudits-17041" /><ref name="cointelegraph-17042" /><ref name="ramprasadgoud34medium-17043" /><ref name="theblock-17044" /><ref name="moonshiestytwitter-17045" /><ref name="onesafe-17046" /><ref name="web3isgoinggreat-17047" /><ref name="aptoslabsexplorer-17048" /><ref name="aptoslabsexplorer-17049" />

== About Thala Labs ==
"Thala Labs provides an automated market maker and a yield-bearing stablecoin for the Aptos ecosystem known as the Move Dollar (MOD), named after Aptos' programming language. The protocol has the fourth-highest total value locked (TVL) of any DeFi protocol on Aptos, according to DefiLlama data."

"Thala is a suite of decentralized finance (DeFi) primitives serving as the backbone of the Aptos ecosystem. The protocol revolves around three modules: AMM, CDP, and LST."

"Thala Swap is an automated market maker (AMM) that offers a range of advanced features and pool types to facilitate efficient liquidity provision and optimization. The protocol supports stable pools and weighted pools, which enables more flexible and tailored liquidity pools –– including liquidity bootstrapping pools (LBPs) to facilitate token launches. The Thala AMM unlocks composability and enables greater internal liquidity within the Thala ecosystem, providing a foundation for the growth and development of the broader Aptos and Move ecosystem."

"Move Dollar (MOD) is an over-collateralized, yield-bearing stablecoin designed for the Aptos ecosystem. It is backed by a diverse basket of on-chain assets, including liquid staked derivatives, liquidity pool tokens, deposit receipt tokens, and real-world assets (RWAs). This diverse collateral base ensures that MOD remains decentralized, censorship-resistant, and capital-efficient."

"Thala's Aptos (APT) liquid staking derivative follows a two-token model to enable greater yields relative to native staking. thAPT is a non-rebasing deposit receipt that is pegged to APT at a 1:1 ratio, while sthAPT is a rebasing deposit receipt that grows as validator rewards accrue over time."

== The Reality ==
The Thala Labs smart contract was closed source and they did not have a bug bounty program, preventing the community from constructively discovering the vulnerability.

== What Happened ==
"The Aptos-based DeFi project Thala suffered a security breach as a result of an isolated vulnerability in the latest update to v1 farming contracts, allowing the exploiter to withdraw liquidity pool tokens totaling $25.5m."
{| class="wikitable"
|+Key Event Timeline - Thala Labs V1 Farming Contract Vulnerability
!Date
!Event
!Description
|-
|November 15th, 2024 7:25:36 AM MST
|Attacker Funds Account
|The attacker funds their Aptos wallet in preparation for the attack.
|-
|November 15th, 2024 12:32:09 PM MST
|Funds Returned By Attacker
|The funds were returned to the Thala Labs treasury account.
|-
|November 16th, 2024 1:33:00 AM MST
|Thala Team Tweet
|Thala posted an update to Twitter/X, reporting the losses were due to a vulnerability in the latest update to their v1 farming contracts, resulting in the theft of $25.5 million in liquidity pool tokens. The team quickly paused all affected contracts, froze $9 million in MOD and $2.5 million in THL tokens, and, with law enforcement's help, identified the exploiter and negotiated a $300k bounty for the full recovery of user assets. Affected users need not take any action, and their positions will be fully restored. The Thala frontend and relevant contracts remain paused for security, but CDP and LST module positions are unaffected. An extensive codebase review and re-audit are underway, with further updates to follow.
|-
|November 16th, 2024 11:22:00 PM MST
|Application Is Back Live
|Thala Finance announces that their application is once again live, however the staking and unstaking functions will not be possible until an audit has been completed.
|}

== Technical Details ==
"The farming contract didn’t validate input values correctly, allowing the attacker to bypass standard checks."

"The Thala hack was made possible by a vulnerability in a recent update to the project’s smart contract code. A missing sanity check for withdrawing staked assets — validating that the user in question actually had a stake of the requested size — could have cost the project $25.5 million and ended up with a price tag of $300,000 in bounty payments."

== Total Amount Lost ==
"The hacker stole $9 million worth of MOD tokens and $2.5 million worth of Thala's native governance token, THL, which the protocol was able to freeze."

The total amount lost has been estimated at $25,500,000 USD.

== Immediate Reactions ==
"Thala has since paused all related contracts and frozen Thala token assets ($9m MOD and $2.5m THL). With the assistance of other organizations, the team identified the exploiter and negotiated a $300k bounty for a full recovery of user assets."

== Ultimate Outcome ==
"[SEAL 911] identified the white hat hacker within minutes (i.e. name, location etc.) due to obvious onchain links. Fortunately, the white hat hacker reached out themselves a little bit later and returned the funds minus a bounty themselves," SEAL 911 member @pcaversaccio said. "It was a very easy win in that case, since no real negotiation was needed."

"While the hacked funds were fully recovered, the Thala token is still down about 35% since the incident occurred."

A bounty of $300,000 USD was paid for the discovery.

== Total Amount Recovered ==
The total amount recovered has been estimated at $25,200,000 USD.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="thalalabstwitter-17036">[https://twitter.com/thalalabs/status/1857703541089120541 @thalalabs Twitter] (Accessed Dec 20, 2024)</ref>

<ref name="thalafi-17037">[https://www.thala.fi/ Thala Labs - Decentralized. Scalable. Liquid] (Accessed Dec 20, 2024)</ref>

<ref name="thalafidocs-17038">[https://docs.thala.fi/overview Thala Protocol | Thala] (Accessed Dec 20, 2024)</ref>

<ref name="thalalabstwitter-17039">[https://twitter.com/ThalaLabs/status/1858033047666569391 @ThalaLabs Twitter] (Accessed Dec 20, 2024)</ref>

<ref name="halborn-17040">[https://www.halborn.com/blog/post/explained-the-thala-hack-november-2024 Explained: The Thala Hack (November 2024)] (Accessed Dec 20, 2024)</ref>

<ref name="quillaudits-17041">[https://www.quillaudits.com/blog/hack-analysis/thala-defi-hack-analysis Breaking Down the Thala DeFi Hack & Move's Decompilation Risks] (Accessed Dec 20, 2024)</ref>

<ref name="cointelegraph-17042">[https://cointelegraph.com/news/thala-recovers-25-million-exploiter-hacker-caught https://cointelegraph.com/news/thala-recovers-25-million-exploiter-hacker-caught] (Accessed Dec 20, 2024)</ref>

<ref name="ramprasadgoud34medium-17043">[https://medium.com/@ramprasadgoud34/thala-protocols-recovery-from-a-25m-exploit-0a06c3faf24a Thala Protocol’s Recovery from a $25M Exploit | by Ramprasad goud | Dec, 2024 | Medium] (Accessed Dec 20, 2024)</ref>

<ref name="theblock-17044">[https://www.theblock.co/post/326937/defi-protocol-thala-recovers-25-million-following-successful-hacker-negotiation https://www.theblock.co/post/326937/defi-protocol-thala-recovers-25-million-following-successful-hacker-negotiation] (Accessed Dec 20, 2024)</ref>

<ref name="moonshiestytwitter-17045">[https://twitter.com/moon_shiesty/status/1857886309580157260 @moon_shiesty Twitter] (Accessed Dec 20, 2024)</ref>

<ref name="onesafe-17046">[https://www.onesafe.io/blog/thala-labs-crypto-security-breach-recovery DeFi Resilience: The Thala Labs Case Study - OneSafe Blog] (Accessed Dec 20, 2024)</ref>

<ref name="web3isgoinggreat-17047">[https://www.web3isgoinggreat.com/?id=thala-hack Thala Labs loses, then recovers, $25.5 million] (Accessed Dec 20, 2024)</ref>

<ref name="aptoslabsexplorer-17048">[https://explorer.aptoslabs.com/txn/e4e03b123879aa0f021c8dc40791c750f267277fbb34a58ebd8ac8e2bf51a7de Aptos Explorer] (Accessed Dec 20, 2024)</ref>

<ref name="aptoslabsexplorer-17049">[https://explorer.aptoslabs.com/txn/1929190925 Aptos Explorer] (Accessed Dec 20, 2024)</ref></references>

Thala Labs V1 Farming Contract Vulnerability - Revision history