DeFi Saver Malicious DNS Hijack

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

DeFi Saver

About DeFi Saver

"DeFi Saver is a one-stop dashboard for creating, managing and tracking your DeFi positions." "Automation can manage your leverage and protect your position from liquidation based on your input, non-custodially and trustlessly."

"DeFi Saver is a management dashboard for decentralized finance protocols, including MakerDAO CDPs (with features such as automatic liquidation protection), as well as Compound, dYdX and Fulcrum."

"With DeFi Saver you can manage and interact between decentralized finance protocols. By creating strategies you can create advanced actions that will be executed automatically when certain conditions are met. The code is open source and runs on the Ethereum blockchain."

The Reality

While the smart contract operates in a decentralized manner, most users will tend to interact with the contracts using transactions generated by a centralized website. When a domain name is accessed on the internet, a service called DNS is used to point the domain name to an IP address.

The Defi Saver project used NameCheap for their registrar for their primary website. The procedures at NameCheap were such that support team members were able to override the DNS of the website to point the domain name to a malicious server.

What Happened

The account of a customer support agent for NameCheap was hacked.

"The attacker was able to access the NameCheap account, even with 2-factor authentication enabled, a strong password, and security alerts. Convex team still had access to the account; 2FA was still enabled, the password was the same, but the attacker was still able to access the account, change the DNS to point to the malicious website, and disable security alerts."

Key Event Timeline - DeFi Saver Malicious DNS Hijack

Date	Event	Description
March 22nd, 2022	Domain Vault Announced	The first archived appearance of the "Domain Vault" service on NameCheap which costs $19.88/mo and is still "coming soon".
June 24th, 2022 5:48:00 AM	DeFi Saver Reports Exploit	The Defi Saver team publicly acknowledges the incident on Twitter.
June 24th, 2022 10:01:00 AM	NameCheap Response	NameCheap responds that "We've traced this down to a specific CS agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."
June 24th, 2022 11:21:00 AM	NameCheap DomainVault	"Usually we require a pin code from customer. We also monitor all actions as well a monitor a real time vip list. In the end our [customer support] needs to be able to modify to help customers especially when 99% don't understand dns. If you want complete security use [DomainVault]"
June 24th, 2022 4:16:00 PM	NameCheap Clarifies Hack	NameCheap responds that it "[l]ooks more like [their customer support] person was hacked."

Total Amount Lost

According to Defi Saver's "knowledge and analysis", the attackers were not successful in taking any funds from their users.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

Defi Saver reported the attack on Twitter the following day:

We experienced an attempted DNS attack on http://DeFiSaver.com yeste[r]day.

Based on our knowledge and analysis, no users were affected in any way.

The common denominator with @ConvexFinance and @RibbonFinance was @Namecheap and we invite other projects to exercise caution.

Twitter user @psyOPs_ accused the team of not using two-factor authentication and clarification was provided.

hi. namecheap user here. no issues. no news of any data breaches. suspect real common denominator here was accounts not using 2FA security.

We certainly did use 2FA, as mentioned and as did other teams. Is there a reason why you would expect your domain to be targe[t]ed in this kind of attack, i.e. is it a domain of a defi protocol which is the other common denominator in this case?

Twitter user 0xPooka confirmed they are switching away from NameCheap.

Just switched all my domains from Namecheap to AWS Route 53 the other day. Took 15 minutes

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

The issue ultimately stemmed from a single customer support agent being compromised. A multi-signature requirement on DNS changes would have prevented this scenario entirely.

While NameCheap offers advanced protections on their domain names, this service had just launched two days prior to the DNS change, so it was unlikely to be a reasonable expectation that Convex Finance would have already signed up.

Users of platforms need to be careful and double check any new approval requested by any platform against the proper smart contract address. It is recommended to double check any new smart contract addresses being interacted with.