Zerion Balancer Clone Phishing Attack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Zerion

Zerion is not an exchange platform, but a non-custodial utility for investors to use to manage their portfolios.

At one point, a balancer clone was tricked into being listed on the platform, which caused one user to lose $30k into the fake contract.

There is no word on whether the user's funds were recovered.

This is a global/international case not involving a specific country.

About Zerion

"Zerion is the easiest way to build and manage your entire DeFi portfolio from one place. Discover the world of decentralized finance today."

"If you’re completely new to decentralized finance (DeFi), then you’re in the right place! Zerion is the simplest way to invest in DeFi from anywhere in the world."

"Zerion is non-custodial, which means we don’t have user accounts and never have access to your funds." "The Zerion interface lets you do just about everything with your DeFi assets — earn interest on passive funds by investing in liquidity pools or providing collateral to crypto loans, borrow crypto to leverage the market, or trade tokens at the best rates." "[D]ownload the Zerion Android or iOS app. You can now track your assets on the go, get the best DeFi rates and explore latest market trends using the Explore Tab."

"In February, an attacker deployed a contract designed to mimic a Balancer pool. This pool appeared on Zerion long enough for one user to interact with it and around $30K in funds were stolen. Fortunately, no one else was affected."

"This attack involved a smart contract designed to mimic a real Balancer pool, with a catch: the contract was built for one-way transactions, accepting deposits but not withdrawals. Several features enabled the pool to bypass detection by our backend. The pool held legitimate underlying tokens, the pool’s contract emitted the same event logs as other Balancer pools, and the contract reported a large token supply." "Consequently, our backend interpreted the fake contract as a real Balancer pool and the token appeared on our Invest page."

"This attack also exploited one of our user-facing security features. The DeFi blue tick is an icon that appears next to assets that appear in at least two Token Lists. While this feature says nothing about the quality of the projects those tokens represent, users can at least proceed knowing they’re not interacting with a duplicitous smart contract. This logic extends to derivative-type tokens on protocols like Uniswap, Balancer and Curve. If the underlying assets of a pool are verified in at least two Token Lists, we assume the pool itself is also legitimate."

"In this case, because the contract behaved exactly like any other Balancer pool and held legitimate underlying tokens, the asset was assigned a blue tick."

"This exploit was on Zerion’s backend security and not the Balancer protocol itself. We immediately resolved the issue with the user and added code to validate each pool against Balancer’s on-chain registry. We’ve also spent the past month doing a thorough security audit and have made key improvements to ensure this never happens again."

"This may be the first attack of its kind on a DeFi aggregator, so we felt it was necessary to break down exactly how this happened and open the dialogue with our community on how we can build a more secure product."

"As a first step, we disabled the automatic blue tick for all derivative tokens on Zerion — this includes pools, indexes, automated strategies, and collateral tokens."

"We want to emphasize that for conventional non-derivative tokens, the blue tick works as intended. We also want to remind users to always err on the side of caution when interacting with DeFi assets. Ultimately, due diligence rests in your hands. The blue tick will help to ensure you’re interacting with legitimate assets (and we can be sure of that with this recent round of improvements), but it is not an indicator of the quality of a token. In other words, the tick doesn’t guarantee that the asset is not a scam."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Zerion Balancer Clone Phishing Attack

Date	Event	Description
March 4th, 2021	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $30,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.