Soda Finance Loophole

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Soda Finance

Soda Finance is a yield farming project run by an anonymous team. There was a loophole in the smart contract, which was ignored by the team. The loophole was exploited. The team partially compensated affected users. The project is still running.

This is a global/international case not involving a specific country.

About Soda Finance

"SODA is the next generation of DeFi that will take Yield Farming to where it has never gone before! Strap in and get a straw — this is gonna be soooooo good!" "Ready to be impressed? SODA uses novel dual token economics(SODA and SoETH), and this means that anyone can deposit Wrapped Ethereum (WETH) along with other assets to earn SODA. In return, you can choose to borrow SoETH from the protocol and use SoETH to earn even more SODA."

"SODA is not another yield farming project. The long term goal of SODA is to provide more liquidity and valuable financial services to the Ethereum ecosystem. The current goal is to generate more collateral backed assets from SODA borrowing."

"Our SODA-ETH staking pool has a 5x multiplier & is currently paying out a astounding 4185% APY!"

"The financial blogger "Super Bitcoin" stated on Weibo that Mr. Huai (weibo username "crash X") participated in the liquidity mining project Soda, and suddenly discovered a loophole in which 20,000 ETH can be directly liquidated Drop. But he chose to tell the development team, but the development team did not pay attention. He had no choice but to liquidate an ETH, and sent a Weibo warning to inform the developers of the existence of this bug. One hour later, the parties to the Soda agreement responded by prompting the borrower to repay and the mortgager to withdraw, and at the same time indicated that they would fix the loopholes and suspend the front-end borrowing function. But as of the early morning of September 21st, more than 400 ETH in Soda's mortgage loan pool were still maliciously liquidated. In the morning of the same day, the agreement officially stated on Twitter that the vulnerability has been fixed, and the newly deployed smart contract is expected to take effect at 21:00 on September 22."

"Again, yield farming is a highly risky game. We understand that the SODA token’s price went down a lot, but everything happened was purely due to the supply and demand of the market. Don’t participate in anything that is beyond your risk tolerance."

"We thank you for your patience while we patch and deploy a fix for the bug. Looking back over the past 48 hours, we have done our best to reduce the asset loss. We tracked all the on-chain data and counted the total loss. In total, we found 17 addresses that were affected by this bug, of which 12 addresses totaling 448.339 WETH principal were liquidated by hackers. The actual loss to the victims is 134.5017 WETH which is 30% of the principal."

"We are willing to compensate the remaining 30% of original locked WETH in the form of SoETH from our SodaDev Pool. For example, if you locked 100 WETH, borrowed 70 SoETH, and lost your locked principal, we will send you 30 SoETH as compensation."

"The community is voicing their desire for a security audit and we hear you! We are preparing for a full audit to validate the code and give more trust to the community."

"We're happy to announce that the patch for the bug fix has been deployed and activated. All features are once again live!" "In Soda V2, there will be no more yield farming. However, we will provide different investment strategies though our vaults."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Soda Finance Loophole
Date	Event	Description
September 22nd, 2020 12:00:00 AM	First Event	This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

Having the majority of exchange funds (aka liquidity pool) in a hot wallet (aka smart contract) is never a good idea. However, in the DeFi space, this is the common practice. Having the majority of the liquidity in a cold storage multi-sig would have prevented it being lost due to the exploit.

Having the large scale project run by an anonymous team is never a good idea in case things go wrong with the enormously complex code. Luckily in this case, the team appears not to have malicious intent and had some interest in assisting affected users.