Zerion Balancer Clone Phishing Attack - Revision history

Azoundria at 18:52, 2 May 2023

2023-05-02T18:52:37Z

← Older revision		Revision as of 12:52, 2 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/zerionbalancerclonephishingattack.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/zerionbalancerclonephishingattack.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Zerion.jpg\|thumb\|Zerion]]Zerion is not an exchange platform, but a non-custodial utility for investors to use to manage their portfolios.		[[File:Zerion.jpg\|thumb\|Zerion]]Zerion is not an exchange platform, but a non-custodial utility for investors to use to manage their portfolios.
Line 8:		Line 8:
	There is no word on whether the user's funds were recovered.		There is no word on whether the user's funds were recovered.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="openblocksecgithub-2342" /><ref name="zerionblog-3063" /><ref name="zerion-3064" /><ref name="zerionblog-3065" />
	<ref name="openblocksecgithub-2342" /><ref name="zerionblog-3063" /><ref name="zerion-3064" /><ref name="zerionblog-3065" />

	== About Zerion ==		== About Zerion ==
Line 69:		Line 68:
	!Description		!Description
	\|-		\|-
	\|March 4th, 2021 ~~12:00:00 AM~~		\|March 4th, 2021
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 77:		Line 76:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 96:		Line 98:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	~~Which policies could have prevented this event from happening?~~

	== References ==		== References ==
	<references><ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10, 2021)</ref>		<references><ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 11, 2021)</ref>

	<ref name="zerionblog-3063">[https://blog.zerion.io/post-mortem-on-zerions-asset-phishing-attack-4fa9516414a3 Post mortem on Zerion’s asset phishing attack \| by Evgeny Yurtaev \| Zerion] (Aug 10, 2021)</ref>		<ref name="zerionblog-3063">[https://blog.zerion.io/post-mortem-on-zerions-asset-phishing-attack-4fa9516414a3 Post mortem on Zerion’s asset phishing attack \| by Evgeny Yurtaev \| Zerion] (Aug 11, 2021)</ref>

	<ref name="zerion-3064">[https://zerion.io/ Web3 Crypto Wallet With NFT & DeFi Portfolio Tracker - Zerion] (Aug 20, 2021)</ref>		<ref name="zerion-3064">[https://zerion.io/ Web3 Crypto Wallet With NFT & DeFi Portfolio Tracker - Zerion] (Aug 21, 2021)</ref>

	<ref name="zerionblog-3065">[https://blog.zerion.io/how-to-create-a-defi-portfolio-c2de906a8baa How to Create a DeFi Portfolio] (Sep 17, 2021)</ref></references>		<ref name="zerionblog-3065">[https://blog.zerion.io/how-to-create-a-defi-portfolio-c2de906a8baa How to Create a DeFi Portfolio] (Sep 18, 2021)</ref></references>

Azoundria at 19:57, 17 February 2023

2023-02-17T19:57:40Z

← Older revision		Revision as of 13:57, 17 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/zerionbalancerclonephishingattack.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/zerionbalancerclonephishingattack.php}}
			{{Unattributed Citations}}

	[[File:Zerion.jpg\|thumb\|Zerion]]Zerion is not an exchange platform, but a non-custodial utility for investors to use to manage their portfolios.		[[File:Zerion.jpg\|thumb\|Zerion]]Zerion is not an exchange platform, but a non-custodial utility for investors to use to manage their portfolios.
Line 8:		Line 9:

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="openblocksecgithub-2342" /><ref name="zerionblog-3063" /><ref name="zerion-3064" /><ref name="zerionblog-3065" />

	== About Zerion ==		== About Zerion ==
Line 47:		Line 49:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 69:		Line 70:
	\|-		\|-
	\|March 4th, 2021 12:00:00 AM		\|March 4th, 2021 12:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 82:		Line 79:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $30,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 93:		Line 90:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 101:		Line 98:

	== Prevention Policies ==		== Prevention Policies ==
			Which policies could have prevented this event from happening?

	== References ==		== References ==
	[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10)		<references><ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10, 2021)</ref>

	[https://blog.zerion.io/post-mortem-on-zerions-asset-phishing-attack-4fa9516414a3 Post mortem on Zerion’s asset phishing attack \| by Evgeny Yurtaev \| Zerion] (Aug 10)		<ref name="zerionblog-3063">[https://blog.zerion.io/post-mortem-on-zerions-asset-phishing-attack-4fa9516414a3 Post mortem on Zerion’s asset phishing attack \| by Evgeny Yurtaev \| Zerion] (Aug 10, 2021)</ref>

	[https://zerion.io/ Web3 Crypto Wallet With NFT & DeFi Portfolio Tracker - Zerion] (Aug 20)		<ref name="zerion-3064">[https://zerion.io/ Web3 Crypto Wallet With NFT & DeFi Portfolio Tracker - Zerion] (Aug 20, 2021)</ref>

	[https://blog.zerion.io/how-to-create-a-defi-portfolio-c2de906a8baa How to Create a DeFi Portfolio] (Sep 17)		<ref name="zerionblog-3065">[https://blog.zerion.io/how-to-create-a-defi-portfolio-c2de906a8baa How to Create a DeFi Portfolio] (Sep 17, 2021)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/zerionbalancerclonephishingattack.php}} ZerionZerion is not an exchange platform, but a non-custodial utility for investors to use to manage their portfolios. At one point, a balancer clone was tricked into being listed on the platform, which caused one user to lose $30k into the fake contract. There is no word on whether the user's funds were recovered. This is a glob..."

2023-01-26T05:26:16Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/zerionbalancerclonephishingattack.php}} thumb|ZerionZerion is not an exchange platform, but a non-custodial utility for investors to use to manage their portfolios. At one point, a balancer clone was tricked into being listed on the platform, which caused one user to lose $30k into the fake contract. There is no word on whether the user's funds were recovered. This is a glob..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/zerionbalancerclonephishingattack.php}}

[[File:Zerion.jpg|thumb|Zerion]]Zerion is not an exchange platform, but a non-custodial utility for investors to use to manage their portfolios.

At one point, a balancer clone was tricked into being listed on the platform, which caused one user to lose $30k into the fake contract.

There is no word on whether the user's funds were recovered.

This is a global/international case not involving a specific country.

== About Zerion ==
"Zerion is the easiest way to build and manage your entire DeFi portfolio from one place. Discover the world of decentralized finance today."

"If you’re completely new to decentralized finance (DeFi), then you’re in the right place! Zerion is the simplest way to invest in DeFi from anywhere in the world."

"Zerion is non-custodial, which means we don’t have user accounts and never have access to your funds." "The Zerion interface lets you do just about everything with your DeFi assets — earn interest on passive funds by investing in liquidity pools or providing collateral to crypto loans, borrow crypto to leverage the market, or trade tokens at the best rates." "[D]ownload the Zerion Android or iOS app. You can now track your assets on the go, get the best DeFi rates and explore latest market trends using the Explore Tab."

"In February, an attacker deployed a contract designed to mimic a Balancer pool. This pool appeared on Zerion long enough for one user to interact with it and around $30K in funds were stolen. Fortunately, no one else was affected."

"This attack involved a smart contract designed to mimic a real Balancer pool, with a catch: the contract was built for one-way transactions, accepting deposits but not withdrawals. Several features enabled the pool to bypass detection by our backend. The pool held legitimate underlying tokens, the pool’s contract emitted the same event logs as other Balancer pools, and the contract reported a large token supply." "Consequently, our backend interpreted the fake contract as a real Balancer pool and the token appeared on our Invest page."

"This attack also exploited one of our user-facing security features. The DeFi blue tick is an icon that appears next to assets that appear in at least two Token Lists. While this feature says nothing about the quality of the projects those tokens represent, users can at least proceed knowing they’re not interacting with a duplicitous smart contract. This logic extends to derivative-type tokens on protocols like Uniswap, Balancer and Curve. If the underlying assets of a pool are verified in at least two Token Lists, we assume the pool itself is also legitimate."

"In this case, because the contract behaved exactly like any other Balancer pool and held legitimate underlying tokens, the asset was assigned a blue tick."

"This exploit was on Zerion’s backend security and not the Balancer protocol itself. We immediately resolved the issue with the user and added code to validate each pool against Balancer’s on-chain registry. We’ve also spent the past month doing a thorough security audit and have made key improvements to ensure this never happens again."

"This may be the first attack of its kind on a DeFi aggregator, so we felt it was necessary to break down exactly how this happened and open the dialogue with our community on how we can build a more secure product."

"As a first step, we disabled the automatic blue tick for all derivative tokens on Zerion — this includes pools, indexes, automated strategies, and collateral tokens."

"We want to emphasize that for conventional non-derivative tokens, the blue tick works as intended. We also want to remind users to always err on the side of caution when interacting with DeFi assets. Ultimately, due diligence rests in your hands. The blue tick will help to ensure you’re interacting with legitimate assets (and we can be sure of that with this recent round of improvements), but it is not an indicator of the quality of a token. In other words, the tick doesn’t guarantee that the asset is not a scam."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Zerion Balancer Clone Phishing Attack
!Date
!Event
!Description
|-
|March 4th, 2021 12:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==

== References ==
[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10)

[https://blog.zerion.io/post-mortem-on-zerions-asset-phishing-attack-4fa9516414a3 Post mortem on Zerion’s asset phishing attack | by Evgeny Yurtaev | Zerion] (Aug 10)

[https://zerion.io/ Web3 Crypto Wallet With NFT & DeFi Portfolio Tracker - Zerion] (Aug 20)

[https://blog.zerion.io/how-to-create-a-defi-portfolio-c2de906a8baa How to Create a DeFi Portfolio] (Sep 17)