Ribbon Finance Malicious DNS Hijack: Difference between revisions

From Quadriga Initiative Cryptocurrency Hacks, Scams, and Frauds Repository
Jump to navigation Jump to search
Line 129: Line 129:


<ref name="cloudflarewhatisdns-10527">[https://www.cloudflare.com/learning/dns/what-is-dns/ https://www.cloudflare.com/learning/dns/what-is-dns/] (Feb 9, 2023)</ref>
<ref name="cloudflarewhatisdns-10527">[https://www.cloudflare.com/learning/dns/what-is-dns/ https://www.cloudflare.com/learning/dns/what-is-dns/] (Feb 9, 2023)</ref>
<ref name="alexintoshtwitter-8874">[https://twitter.com/Alexintosh/status/1540047636467748870 @Alexintosh Twitter] (Aug 23, 2022)</ref>


<ref name="convexpostmortem-8882">[https://convexfinance.medium.com/post-mortem-of-events-june-23-3d6db955dc7d Post Mortem Of Events June 23] (Aug 24, 2022)</ref>
<ref name="convexpostmortem-8882">[https://convexfinance.medium.com/post-mortem-of-events-june-23-3d6db955dc7d Post Mortem Of Events June 23] (Aug 24, 2022)</ref>
Line 137: Line 139:


<ref name="namecheapceotwitter1-8884">[https://twitter.com/NamecheapCEO/status/1540364576151289857 @NamecheapCEO Twitter] (Aug 24, 2022)</ref>
<ref name="namecheapceotwitter1-8884">[https://twitter.com/NamecheapCEO/status/1540364576151289857 @NamecheapCEO Twitter] (Aug 24, 2022)</ref>
<ref name="convexcontractaddresses-8886">[https://docs.convexfinance.fi/convexfinance/faq/contract-addresses Contract Addresses - ConvexFinance] (Aug 24, 2022)</ref>


<ref name="devancollins3replytwitter-8894">[https://twitter.com/DevanCollins3/status/1338967305297027081 @DevanCollins3 Twitter] (Aug 24, 2022)</ref>
<ref name="devancollins3replytwitter-8894">[https://twitter.com/DevanCollins3/status/1338967305297027081 @DevanCollins3 Twitter] (Aug 24, 2022)</ref>
Line 145: Line 149:


<ref name="namecheapceotwitter3-10566">[https://twitter.com/NamecheapCEO/status/1540458990831894532 @NamecheapCEO Twitter] (Feb 11, 2023)</ref></references>
<ref name="namecheapceotwitter3-10566">[https://twitter.com/NamecheapCEO/status/1540458990831894532 @NamecheapCEO Twitter] (Feb 11, 2023)</ref></references>
<ref name="namecheapdomainvault2-10567">[https://web.archive.org/web/20220619232321/https://www.namecheap.com/security/domain-vault/ Premium domain protection – Domain Vault - Namecheap] (Feb 12, 2023)</ref>
<ref name="namecheapdomainvault3-10568">[https://web.archive.org/web/20220620234159/https://www.namecheap.com/security/domain-vault/ Premium domain protection – Domain Vault - Namecheap] (Feb 12, 2023)</ref>
<ref name="namecheapdomainvault4-10569">[https://web.archive.org/web/20220624011230/https://www.namecheap.com/security/domain-vault/ Premium domain protection – Domain Vault - Namecheap] (Feb 13, 2023)</ref>
<ref name="namecheapdomainvault5-10570">[https://web.archive.org/web/20220625021642/https://www.namecheap.com/security/domain-vault/ Premium domain protection – Domain Vault - Namecheap] (Feb 13, 2023)</ref>
<ref name="namecheapdomainvault6-10571">[https://web.archive.org/web/20220701041551/https://www.namecheap.com/security/domain-vault/ Premium domain protection – Domain Vault - Namecheap] (Feb 13, 2023)</ref>
<ref name="namecheapdomainvault7-10572">[https://web.archive.org/web/20220702050733/https://www.namecheap.com/security/domain-vault/ Premium domain protection – Domain Vault - Namecheap] (Feb 13, 2023)</ref>
<ref name="convexannouncespostmortem-10584">[https://twitter.com/ConvexFinance/status/1542904483704934400 @ConvexFinance Twitter] (Feb 18, 2023)</ref></references>

Revision as of 18:36, 22 February 2023

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Ribbon Finance


About Ribbon Finance

"SUSTAINABLE ALPHA FOR EVERYONE" "Earn yield on your cryptoassets with DeFi's first structured products protocol." "Ribbon Finance is a new protocol that helps users access crypto structured products for DeFi. It combines options, futures, and fixed income to improve a portfolio's risk-return profile."[1]

"Theta Vault, which is a yield-focused strategy on ETH and WBTC. The vault earns yield on its deposits by running a weekly automated options selling strategy. The vault reinvests the yield earned back into the strategy, effectively compounding the yields for depositors over time."[2]

"Ribbon's v1 and v2 Theta Vault contracts are audited[3]. Despite the audits and security measures we have taken, we advice users to exercise caution and to not risk funds they are not willing to lose."[4] Audits were found provided by Quantstamp[5], ChainSafe (2 audits)[6], Peckshield[7], and OpenZeppelin[8]. "We have an ongoing bug bounty on ImmuneFi, with up to $50,000 of bounty. The contracts that are included in the bounty are ETH and WBTC Theta Vaults."

The Reality

While the smart contract operates in a decentralized manner, most users will tend to interact with the contracts using transactions generated by a centralized website. When a domain name is accessed on the internet, a service called DNS is used to point the domain name to an IP address[9].

The Ribbon Finance project used NameCheap for their registrar for their primary website[10]. The procedures at NameCheap were such that support team members were able to override the DNS of the website to point the domain name to a malicious server[11][12][13].

What Happened

The account of a customer support agent for NameCheap was hacked[14].

"The attacker was able to access the NameCheap account, even with 2-factor authentication enabled, a strong password, and security alerts. Convex team still had access to the account; 2FA was still enabled, the password was the same, but the attacker was still able to access the account, change the DNS to point to the malicious website, and disable security alerts."

The issue was quickly corrected by the Ribbon Finance team, but not before 2 users were affected[15].

Key Event Timeline - Ribbon Finance Malicious DNS Hijack
Date Event Description
March 22nd, 2022 Domain Vault Announced The first archived appearance of the "Domain Vault" service on NameCheap which costs $19.88/mo and is still "coming soon"[16].
June 20th, 2022 Domain Vault Launches The NameCheap "Domain Vault" service now switches from "Get early access" to "Get Domain Vault" with the price remaining at $19.88/mo[17][18].
June 23rd, 2022 1:02:00 PM Alexintosh Tweet The Twitter user @alexintosh reported an abnormal approval requested by the Convex Finance website, with a similar but not exact smart contract address[19][20][21].
June 23rd, 2022 9:57:59 PM Massive WBTC Theft A total of 16.50942255 WBTC are transferred from one victim of the DNS exploit to the attacker[22].
June 24th, 2022 2:29:00 AM Immediate Remediation Ribbon Finance posts on Twitter that they have "immediately remedied the issue"[15].
June 24th, 2022 4:10:00 AM MistTrack Analysis MistTrack is one of the first firms to report on the issue, providing a blockchain transaction for 16.5 WBTC (wrapped bitcoin)[23].
June 24th, 2022 10:01:00 AM NameCheap Response NameCheap responds that "We've traced this down to a specific CS agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."[24]
June 24th, 2022 11:21:00 AM NameCheap DomainVault "Usually we require a pin code from customer. We also monitor all actions as well a monitor a real time vip list. In the end our [customer support] needs to be able to modify to help customers especially when 99% don't understand dns. If you want complete security use [DomainVault]"[25]
June 24th, 2022 4:16:00 PM NameCheap Clarifies Hack NameCheap responds that it "[l]ooks more like [their customer support] person was hacked."[14]
June 24th, 2022 4:16:00 PM NameCheap Clarifies Hack NameCheap responds that it "[l]ooks more like [their customer support] person was hacked."[14]
June 25th, 2022 Domain Vault Discount NameCheap lowers the price of their Domain Vault service from $19.88/mo[26] to $1.88/mo[27].
July 1st, 2022 10:14:00 AM Postmortem Released Convex Finance releases a post-mortem report with further details of what happened, how much was lost, and their compensation plans[28][10].
July 2nd, 2022 Price Segmentation NameCheap decides to offer two different Domain Vault services from "Silver" tier at $1.88/mo[29] to "Titanium" tier at $19.88/mo[30].

Total Amount Lost

Ribbon Finance reports that at least 2 users were affected by the incident[15].

MistTrack reports one of the users lost 16.5 WBTC[23]. Blockchain analysis shows that the exact amount was 16.50942255 WBTC[22]. The closing market price of wrapped bitcoin on June 23rd, 2022 was $21,057.95 USD[31]. This creates a loss estimate of $347,654.59 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

Ribbon Finance reported an "immediate remedy" on their Twitter shortly after the DNS issue was initially reported[15].

We are aware of a DNS attack on http://app.ribbon.finance and have immediately remedied the issue.

The takeover prompted 2 users to approve malicious contracts for vault deposits.

All funds on the vault contract are unaffected.

MistTrack was one of the first to respond to the situation, highlighting a transaction for the theft of 16.5 WBTC[23].

On-chain analysis showed that it was the same attacker as Convex. One victim lost 16.5 WBTC.

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

The issue ultimately stemmed from a single customer support agent being compromised. A multi-signature requirement on DNS changes would have prevented this scenario entirely.

While NameCheap offers advanced protections on their domain names, this service had just launched two days prior to the DNS change, so it was unlikely to be a reasonable expectation that Convex Finance would have already signed up.

Users of platforms need to be careful and double check any new approval requested by any platform against the proper smart contract address. It is recommended to double check any new smart contract addresses being interacted with.

References

  1. ↑ Ribbon Finance: Crypto structured products on Ethereum (Oct 12, 2021)
  2. ↑ Introduction to Ribbon - Ribbon Finance (Dec 4, 2021)
  3. ↑ audit/RibbonThetaVault V2 Smart Contract Review And Verification.pdf at master · ribbon-finance/audit · GitHub (Dec 4, 2021)
  4. ↑ Security - Ribbon Finance (Dec 4, 2021)
  5. ↑ audit/Quantstamp Theta Vault.pdf at master · ribbon-finance/audit · GitHub (Dec 4, 2021)
  6. ↑ audits/Ribbon-Audit_April-2021.pdf at main · ChainSafe/audits · GitHub (Dec 4, 2021)
  7. ↑ audit/PeckShield-Audit-Report-Ribbon-v1.0.pdf at master · ribbon-finance/audit · GitHub (Dec 4, 2021)
  8. ↑ Ribbon Finance Audit - OpenZeppelin blog (Dec 4, 2021)
  9. ↑ https://www.cloudflare.com/learning/dns/what-is-dns/ (Feb 9, 2023)
  10. ↑ 10.0 10.1 Post Mortem Of Events June 23 (Aug 24, 2022)
  11. ↑ @ConvexFinance Twitter (Aug 24, 2022)
  12. ↑ @DevanCollins3 Twitter (Aug 24, 2022)
  13. ↑ @LefterisJP Twitter (Feb 10, 2023)
  14. ↑ 14.0 14.1 14.2 @NamecheapCEO Twitter (Feb 11, 2023)
  15. ↑ 15.0 15.1 15.2 15.3 Ribbon Finance Reports Remedy - Twitter (Feb 22, 2023)
  16. ↑ Premium domain protection – Domain Vault - Namecheap (Feb 9, 2023)
  17. ↑ Cite error: Invalid <ref> tag; no text was provided for refs named namecheapdomainvault2-10567
  18. ↑ Cite error: Invalid <ref> tag; no text was provided for refs named namecheapdomainvault3-10568
  19. ↑ @Alexintosh Twitter (Aug 23, 2022)
  20. ↑ Contract Addresses - ConvexFinance (Aug 24, 2022)
  21. ↑ Cite error: Invalid <ref> tag; no text was provided for refs named cryptonomist-8870
  22. ↑ 22.0 22.1 Theft Transaction For 16.5 WBTC - Etherscan (Feb 22, 2023)
  23. ↑ 23.0 23.1 23.2 MistTrack Transaction Analysis - Twitter (Feb 22, 2023)
  24. ↑ @NamecheapCEO Twitter (Aug 24, 2022)
  25. ↑ @NamecheapCEO Twitter (Aug 24, 2022)
  26. ↑ Cite error: Invalid <ref> tag; no text was provided for refs named namecheapdomainvault4-10569
  27. ↑ Cite error: Invalid <ref> tag; no text was provided for refs named namecheapdomainvault5-10570
  28. ↑ Cite error: Invalid <ref> tag; no text was provided for refs named convexannouncespostmortem-10584
  29. ↑ Cite error: Invalid <ref> tag; no text was provided for refs named namecheapdomainvault6-10571
  30. ↑ Cite error: Invalid <ref> tag; no text was provided for refs named namecheapdomainvault7-10572
  31. ↑ Wrapped Bitcoin Historic Prices - CoinMarketCap (Feb 22, 2023)

[1]

[2]

[3]

[4]

[5]

[6]

[7]</references>

  1. ↑ Premium domain protection – Domain Vault - Namecheap (Feb 12, 2023)
  2. ↑ Premium domain protection – Domain Vault - Namecheap (Feb 12, 2023)
  3. ↑ Premium domain protection – Domain Vault - Namecheap (Feb 13, 2023)
  4. ↑ Premium domain protection – Domain Vault - Namecheap (Feb 13, 2023)
  5. ↑ Premium domain protection – Domain Vault - Namecheap (Feb 13, 2023)
  6. ↑ Premium domain protection – Domain Vault - Namecheap (Feb 13, 2023)
  7. ↑ @ConvexFinance Twitter (Feb 18, 2023)
Retrieved from "https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=Ribbon_Finance_Malicious_DNS_Hijack&oldid=2563"