Lien Finance Rescued

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Lien Finance

Lien Finance offers some interesting financial products, including an advanced structure of stable coin.

A highly experienced developer found an exploit in the smart contract which had been overlooked by the contract auditor. Rather than exploiting it himself, he attempted to get in touch with the auditor and the project (which was run anonymously). He succeeded.

The transaction was broadcast directly to a mining pool in order to avoid the exploit being stolen from the mempool.

This is a global/international case not involving a specific country.

About Lien Finance

Lien Finance describes itself as a "protocol for creating options and stablecoins out of ETH". "The three core features of LIEN are Tokens (iDOL, LBT, SBT, LIEN), DEX (FairSwap), and the Lien protocol." "The Lien Protocol is the smart contract that makes the bifurcation (tranching) of ETH into a stable coin and a call option possible." "Users can create, trade, and use stable coins and options created from ETH, without worrying about counterparty risk." "Lien aims to eliminate all aspects of governance and centralization of authority." The contract "has been certified by the CertiK audit team and can be confirmed on page 10 of the CertiK audit report."

"On September 15, 2020," a developer Samczsun "noticed that there was a bug within the smart contract with a loophole that contained about 25,000 ETH, which at the time was worth around $9.5 million. Samczsun could easily have taken advantage of this and could drain the contract, but sought the developers of Lien Finance to rectify the bug."

"Realistically, there were two ways the situation could’ve been resolved. First, Lien Finance could’ve publicly disclosed the vulnerability, but that would’ve created a perfect opportunity for hackers to snatch the funds—like placing a “free money” sign."

"Second, the whitehat team could’ve exploited the smart contract itself and then return the funds to their rightful owners. But this would’ve definitely attracted the so-called generalized frontrunner bots—apex predators of Ethereum’s mempool."

"Basically, frontrunners could automatically copy any transaction in the mempool, replace its addresses with their own and make sure that the duplicate operation gets picked up by miners first. In the current situation, that meant $10 million could’ve been easily stolen by frontrunners in a matter of seconds. Secrecy was essential."

"At this point, Sam and Bigelow were finishing the script to generate 4 sequential signed transactions. Processing them in order would not withdraw the ETH 25,000, wrote Bigelow, but would transfer the "falsely" created 30,000 Stable Bond Token (SBT)+Liquid Bond Token (LBT) tokens to the Lien team, subsequently allowing them to submit the final transaction to convert these tokens back into ETH."

"Sparkpool was enlisted by Samczsun to execute the hack on the $10 million Ethereum wallet. This was performed hitch-free and the Ethereum token was passed through Sparkpool and into the Lien wallet after which Lien developers patched the code."

"On September 22, Lien announced that the team had notified them of a bug in the "BondMaker" program, which the protocol said is an integral part of the Lien app. Stating that no funds were lost in the 'rescue' process, and describing that process in detail, Lien said that, once they confirmed that the users’ funds were no longer at risk, they shut down the frontend of the Lien app and notified the community of the incident. They immediately moved on to "tabulating everyone’s balances and made all efforts to return their funds as soon as possible.""

"We have important information that we need to share with the users of the Lien app." "Our code auditors notified us today that they had identified a bug in one of the programs." "No funds have been compromised." "Addresses that held iDOL, LBT, SBT, and LP shares on September 16, 2020 11:07:43 AM UTC will be getting back their funds in ETH." "The amount of ETH they will be receiving will be based on the value of the iDOL, LBT, and SBT calculated by the protocol as of that cut off timing." "The payments will be processed as soon as possible." "Considering the nature of the matter and the urgency involved, we had to wait to make the announcement until we made sure the funds were safe."

As of September 18th, they'd started processing the payments. "Please check your addresses that held iDOL, SBT, LBT, or LP shares at September 16, 2020 11:07:43 AM UTC." "The entire process is expected to take around 6-12 hours." "Refund payments have been completed." "On September 19, 2020, at 21:45 UTC, we completed the refund payments to users."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Lien Finance Rescued

Date	Event	Description
September 15th, 2020	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $9,600,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

The total amount recovered has been estimated at $9,600,000 USD.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

Decentralized finance is a new field, and it is impossible to prove security of funds.

For the time being, safer storage of platform funds would be multi-signature offline wallets, where they can't be subject to exploits.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.