Lien Finance Rescued

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Lien Finance

Lien Finance offers some interesting financial products, including an advanced structure of stable coin.

A highly experienced developer found an exploit in the smart contract which had been overlooked by the contract auditor. Rather than exploiting it himself, he attempted to get in touch with the auditor and the project (which was run anonymously). He succeeded.

The transaction was broadcast directly to a mining pool in order to avoid the exploit being stolen from the mempool.

This is a global/international case not involving a specific country.

About Lien Finance

Lien Finance describes itself as a "protocol for creating options and stablecoins out of ETH". "The three core features of LIEN are Tokens (iDOL, LBT, SBT, LIEN), DEX (FairSwap), and the Lien protocol." "The Lien Protocol is the smart contract that makes the bifurcation (tranching) of ETH into a stable coin and a call option possible." "Users can create, trade, and use stable coins and options created from ETH, without worrying about counterparty risk." "Lien aims to eliminate all aspects of governance and centralization of authority." The contract "has been certified by the CertiK audit team and can be confirmed on page 10 of the CertiK audit report."

"On September 15, 2020," a developer Samczsun "noticed that there was a bug within the smart contract with a loophole that contained about 25,000 ETH, which at the time was worth around $9.5 million. Samczsun could easily have taken advantage of this and could drain the contract, but sought the developers of Lien Finance to rectify the bug."

"Realistically, there were two ways the situation could’ve been resolved. First, Lien Finance could’ve publicly disclosed the vulnerability, but that would’ve created a perfect opportunity for hackers to snatch the funds—like placing a “free money” sign."

"Second, the whitehat team could’ve exploited the smart contract itself and then return the funds to their rightful owners. But this would’ve definitely attracted the so-called generalized frontrunner bots—apex predators of Ethereum’s mempool."

"Basically, frontrunners could automatically copy any transaction in the mempool, replace its addresses with their own and make sure that the duplicate operation gets picked up by miners first. In the current situation, that meant $10 million could’ve been easily stolen by frontrunners in a matter of seconds. Secrecy was essential."

"At this point, Sam and Bigelow were finishing the script to generate 4 sequential signed transactions. Processing them in order would not withdraw the ETH 25,000, wrote Bigelow, but would transfer the "falsely" created 30,000 Stable Bond Token (SBT)+Liquid Bond Token (LBT) tokens to the Lien team, subsequently allowing them to submit the final transaction to convert these tokens back into ETH."

"Sparkpool was enlisted by Samczsun to execute the hack on the $10 million Ethereum wallet. This was performed hitch-free and the Ethereum token was passed through Sparkpool and into the Lien wallet after which Lien developers patched the code."

"On September 22, Lien announced that the team had notified them of a bug in the "BondMaker" program, which the protocol said is an integral part of the Lien app. Stating that no funds were lost in the 'rescue' process, and describing that process in detail, Lien said that, once they confirmed that the users’ funds were no longer at risk, they shut down the frontend of the Lien app and notified the community of the incident. They immediately moved on to "tabulating everyone’s balances and made all efforts to return their funds as soon as possible.""

"We have important information that we need to share with the users of the Lien app." "Our code auditors notified us today that they had identified a bug in one of the programs." "No funds have been compromised." "Addresses that held iDOL, LBT, SBT, and LP shares on September 16, 2020 11:07:43 AM UTC will be getting back their funds in ETH." "The amount of ETH they will be receiving will be based on the value of the iDOL, LBT, and SBT calculated by the protocol as of that cut off timing." "The payments will be processed as soon as possible." "Considering the nature of the matter and the urgency involved, we had to wait to make the announcement until we made sure the funds were safe."

As of September 18th, they'd started processing the payments. "Please check your addresses that held iDOL, SBT, LBT, or LP shares at September 16, 2020 11:07:43 AM UTC." "The entire process is expected to take around 6-12 hours." "Refund payments have been completed." "On September 19, 2020, at 21:45 UTC, we completed the refund payments to users."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Lien Finance Rescued
Date	Event	Description
September 15th, 2020 12:00:00 AM	First Event	This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?