88MPH Init Vulnerability

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

88MPH

The audited 88MPH smart contract hot wallet was storing $6.5m in funds. There was an error in the smart contract which allowed anyone to initialize the contract, thereby granting themselves the mint and burn functionality.

This was discovered by a white hacker before being exploited. As a result, all funds were safe and a bounty was issued.

This is a global/international case not involving a specific country.

About 88MPH

"88mph is a fixed-rate yield-generation protocol." "88mph is a fixed-rate yield-generation protocol on Ethereum that allows users to deposit assets, earn fixed-rate interests, and farm for MPH tokens." You can "lend your crypto assets at a fixed interest rate or buy some floating-rate bonds. By doing so, you earn upfront $MPH token and system rewards." "Earn fixed-rate interest on your crypto and MPH rewards." "[L]end your crypto assets at a fixed interest rate with infinite liquidity." "The first mainnet version was launched in April 2020." The team "started working on a new version of the protocol in June and did [their] first security audit at that time, with the help of an Aave grant."

"88mph protocol is controlled by the MPH community who have the power to shape the future of the protocol. the governance treasury receives the MPH tokens paid back by depositors when they withdraw their deposits. The MPH community can propose and vote on various proposals ranging from protocol parameter changes to smart ways of using the capital assets stored in the treasury for creating new incentives, capitalization, and at the end growth."

88MPH had been audited by PeckShield on January 11th, 2020.

"On 7 June 2021, Ashiq Amien, a security researcher at iosiro, identified a critical bug in the fixed-interest-rate lending protocol 88mph." "The initialization bug was identified in 88mph's NFT contract, and resulted in allowing anyone to claim ownership of the contract and steal the underlying assets."

"The vulnerability was an unprotected init() function in the code of these specific pools that would have allowed a malicious user to steal $6.5m in tokens, mostly in crvRenWBTC." "The vulnerability affected three pools: yaLINK, CRV:STETH, [and] CRV:RENWBTC." "At the time of the disclosure, an attacker would have been able to steal over $6.5 million USD of user assets from the protocol."

"The init() function, which is used to initialize the NFT contract on 88mph’s platform, was missing an onlyOwner modifier, and there was also no initializer modifier to prevent a re-initialization. In other words, the init() function was unprotected and was callable multiple times — and by anyone. The result of this unprotected function was that anyone could have taken ownership of the NFT contract, and ownership came with the privilege of minting pool deposit NFTs and burning any user’s NFT deposit using the mint() and burn() functions. This vulnerability would have allowed a malicious attacker to have access to any user’s NFTs and deposits."

"The bug was reported to 88mph through Immunefi." "The 88mph team responded quickly after receiving the disclosure, restricting access to the vulnerable functionality within 2 hours and extracting the funds to the treasury within 24 hours." "88mph quickly paused the affected contracts, whitehacked all user funds, and returned those funds to their rightful owners after they had been saved."

"During the assessment phase, Duncan Townsend, CTO of Immunefi, reviewed the code and suggested that 88mph pause the contracts by 1) deploying a dummy minter contract that reverted on every call, and 2) setting the minter to that contract. This pause method prevented frontrunning the whitehack and bought enough time to carefully capture all the funds and transfer them to the 88mph multisig wallet. The whitehack was executed on June 8th at 9:46pm UTC."

"The bug was reported to 88mph through Immunefi for a bounty of $42,069." "In recognition of the vulnerability’s potentially devastating impact, 88mph is awarding iosiro a bounty of $42,069 at the request of the whitehat."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - 88MPH Init Vulnerability

Date	Event	Description
June 7th, 2021 12:00:00 AM	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost has been estimated at $6,500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

Smart contracts are a form of hot wallet, and not as secure as cold storage. The issue remained despite professional auditing, which is an important illustration of how hot wallet systems cannot be proven secure.

In general, cold storage with a proper multi-signature wallet held by trained and background checked individuals is a more secure method of storage.