Qubit Finance Platform Deposit Hack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Qubit Finance

Qubit Finance is a decentralized lending platform. Late on January 27th, an attacker brought funds from tornadocash and used them to exploit the smart contract hot wallet, creating a fake deposit and then withdrawing 206,809 Binance coins from the hot wallet. The platform has pledge to continue tracking the funds, and so far the attacker has not made an effort to move them from their wallet. However, given that their source of funds came from TornadoCash, it's unlikely they could be identified unless they attempt to cash out the funds without going through TornadoCash again. A bounty was offered but the attacker has not yet responded.

This is a global/international case not involving a specific country.

About Qubit Finance

"Qubit is a decentralized money market platform that takes advantage of the speed, automation, and security of the blockchain to connect lenders and borrowers efficiently and securely."

"Users of Qubit Finance can participate as lenders and borrowers. Lender: As a liquidity provider, lenders can deposit assets to lend out to others. Liquidity providers will earn interest on their deposited assets. Borrower: A borrower can deposit assets as collateral and borrow assets in return."

"At Qubit, we are committed to making money markets a secure commodity for the entire BSC Ecosystem. Consequently, Qubit does not charge the withdrawal fees that have hindered the innovative applications of more sophisticated leveraged strategies on the BSC."

"Qubit is also explicitly committed to furthering ecosystem security on the BSC. Qubit does this in two ways. First, Qubit does not support flash loans, which eliminates from the platform one of the greatest sources of insecurity in the entire ecosystem."

"Second, Team Qubit will fully support vertically integrated code review and full-stack audits for all whitelisted projects that build on the Qubit platform. This represents a significant but necessary ecosystem investment by Qubit in order to eliminate the vulnerabilities that were injected into the BSC ecosystem by the uncoordinated migrations that interrupted and disrupted many projects this past May."

"At 9:34PM UTC on January 27th, 2022, an attacker began their exploit of Qubit Finance’s Ethereum-BSC bridge." "The attacker called the QBridge deposit function on the ethereum network, which calls the deposit function QBridgeHandler. QBridgeHandler should receive the WETH token, which is the original tokenAddress, and if the person who performed the tx does not have a WETH token, the transfer should not occur," the company explained.

"In summary, the deposit function was a function that should not be used after depositETH was newly developed, but it remained in the contract. The team is cooperating with security and network partners, including Binance. Supply, Redeem, Borrow, Repay, Bridge, and Bridge redemption functions are disabled until further notice. Claiming is available. We are continuing to investigate and are in communications with Binance."

"Blockchain security and data analytics company PeckShield has revealed that the reason for the hack is to create an immense amount of xETH (xplosive Ethereum) collateral. xETH provides a wallet service for secret transactions and brings more privacy to ETH payments. The hackers have created the scheme to drain the whole BNB stored on QBridge."

"Moreover, CertiK, a blockchain security firm, pointed out that the deposit option in QBridge was prone to hackers with which they illegally minted 77,162 qXETH assets in Qubit. Rekt database informed that hackers have used such fraudulent activities several times to convert all the hacked assets to BNB, making it the seventh-largest exploit in DeFi."

"According to blockchain security firm CertiK, the hackers took advantage of a logical error in Qubit Finance’s code. The DeFi platform said the smart contract software bug allowed the hacker to transfer about 206,809 Binance coins worth about $80 million after depositing 0 ETH."

"This exploit ended up netting them 77,162 qXETH ($185 million), which they then used to borrow and convert 15,688 wETH ($37.6 million), 767 BTC-B ($28.5 million), approximately $9.5 million in various stablecoins, and ~$5 million in CAKE, BUNNY, and MDX."

"“The attacker called the ‘deposit()’ function in the QBridge contract without any ETH attached in this transaction,” CertiK wrote."

"The attacker injected malicious data, and the deposit logic failed to invoke a function to verify the data injected. The report noted that the ‘tokenAddress.safeTransferFrom()’ fails to revert when the ‘tokenAddress’ parameter is zero."

"The researchers also discovered two more logical errors that attackers could exploit. One flaw could allow an attacker to deposit ETH and ERC20 tokens using the same event."

"In a conversation today, Tal Be’ery, CTO at cryptocurrency wallet app ZenGo, has also pointed out that Qubit’s hack is part of a larger trend in the cryptocurrency industry."

“Recently a few bridge projects were hacked: Polychain MATIC, Multichain and now Qubit,” Be’ery said.

“Bridge projects, ‘moving’ tokens and coins from one blockchain to another, seem to be more vulnerable to attacks as they don’t move the tokens themselves, but instead use a deposit function to exchange the coin to some internal representation, and do their internal cross-chain accounting with this representation,” he added.

“If there is an error there, the attacker can ‘print’ money in the internal representation and then withdraw it for ‘real’ money,” Be’ery said, explaining the base mechanism behind the hacker’s exploit and how they managed to steal Qubit’s funds.

"Qubit finance said it was tracking the hacker and working with security networks and Binance. Additionally, the DeFi platform disabled the Redeem, Borrow, Repay, Bridge, and Bridge redemption functionalities indefinitely."

"The DeFi platform has also identified the attacker’s address and confirmed that the assets were still in the accounts. Qubit opened an opportunity for negotiations imploring the attacker to engage the company for a negotiable maximum bounty offer."

"Later, the company disclosed that the attacker had swapped all the stolen assets into a single ETH wallet. Qubit promised to commit resources to solve the issue and expressed its willingness to compensate the victims."

"Qubit has asked the hacker to return the funds, so far to no avail." "As of the time of publication, the attacker’s address still holds approximately $80 million of stolen assets."

"Lastly, our willingness to compensate. As early innovators in the DeFi space, our goal is to continue our work. In light of this event, we are committed to developing a means to compensate members of the community who have been affected by this attack."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Qubit Finance Platform Deposit Hack

Date	Event	Description
January 27th, 2022 3:19:00 PM MST	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $79,845,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.