DeFi Saver Malicious DNS Hijack

From Quadriga Initiative Cryptocurrency Hacks, Scams, and Frauds Repository
Jump to navigation Jump to search

DefiSaver is a tool to track and manage DeFi positions. The service used NameCheap to host their primary domain where customers would interact with the service. On June 23rd, a request was made to change the DNS settings on their domain name, which was believed to be due to a vulnerability in NameCheap. This redirected the website to a phishing version, which looked identical to main version but requested approval on a new smart contract with a similar address. The new smart contract allowed the attacker to steal approved funds and was active on the site for a few hours, plus DNS propagation time. The DefiSaver project has stated that none of their users lost any funds as a result of this exploit.

DeFi Saver Homepage/Logo


About DeFi Saver

DeFi Saver is a comprehensive management dashboard designed to assist users in managing their assets and positions across various decentralized finance (DeFi) protocols. It offers features such as automatic liquidation protection for MakerDAO Collateralized Debt Positions (CDPs) and supports other protocols like Compound, dYdX, and Fulcrum[1][2]. With over 441,000 user transactions and a trade volume exceeding $7.5 billion, DeFi Saver supports 16 networks, 4 protocols, and 13 decentralized exchanges and aggregators[2]. The platform offers essential tools for tracking and managing DeFi portfolios, including features for lending and borrowing, advanced decentralized exchange capabilities, leverage management, and a loan shifter for moving positions between different protocols[2]. Automation options such as stop loss, take profit, trailing stop, and automated leverage management are also available, allowing users to protect their positions and optimize returns. DeFi Saver emphasizes security, with audited smart contracts, battle-tested protocols, bug bounty programs, and a non-custodial, trustless approach to user interactions[2]. The platform allows users to create custom DeFi transactions, combining various actions and executing them in a single transaction[2].

The system components include Actions (contracts performing specific actions), Triggers (contracts checking conditions), Recipes (series of bundled actions executed in sequence), Strategies (arrays of triggers and recipes executed by bots), Bundles (lists of strategies with similar triggers and different recipes), and Subscriptions (users subscribing to specific strategies with custom data)[3]. The platform provides users with a centralized interface to efficiently manage and monitor their activities across various DeFi protocols, enhancing convenience and risk management in the decentralized financial ecosystem[1]. The platform has received positive feedback from users and is recognized for its ease of use and risk management capabilities[2].

The Reality

While smart contracts operate in a decentralized "trustless" manner, most users will tend to interact with the contracts using transactions generated by a centralized "trusted" website. When a domain name is accessed on the internet, a service called DNS (Domain Name System) is used to route the user to the appropriate server[4].

The Defi Saver project used NameCheap as their registrar for their primary website[5]. The procedures at NameCheap were such that individual support team members were able to override the DNS of the DefiSaver domain to point the domain name to a malicious server[6][7][8].

What Happened

The account of a customer support agent for NameCheap was hacked or compromised[9].

This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including Convex Finance, Ribbon Finance, Defi Saver, and AllBridge[10]. Authorized as a support agent, the attacker was able to override any 2-factor authentication, passwords, and security alert settings which were present on any of the accounts[11][12][13].

Key Event Timeline - DeFi Saver Malicious DNS Hijack
Date Event Description
March 22nd, 2022 Domain Vault Announced The first archived appearance of the "Domain Vault" service on NameCheap which costs $19.88/mo and is still "coming soon"[14].
June 20th, 2022 3:05:42 AM MDT First Malicious Contract Creation The very first smart contract is created by a wallet controlled from the attacker[15]. Malicious contract 0x65a8...3b2f[16] was created by wallet 0x5622...781a[15][17].
June 20th, 2022 Domain Vault Launches The NameCheap "Domain Vault" service now switches from "Get early access" to "Get Domain Vault" with the price remaining at $19.88/mo[18][19].
June 23rd, 2022 6:17:41 AM MDT Final Malicious Contract The final malicious smart contract is created by the attacker[20].
June 23rd, 2022 1:02:00 PM MDT Alexintosh Convex Finance Tweet The Twitter user @alexintosh reported an abnormal approval requested by the similarly affected Convex Finance website, with a similar but not exact smart contract address[21][22][23].
June 23rd, 2022 2:23:00 PM MDT Please Review Approvals Convex Finance posts their very first announcement on Twitter, requesting users to "[p]lease review approvals while we evaluate a potential front end issue[24]."
June 23rd, 2022 3:46:00 PM MDT Additional Malicious Contracts Twitter user @HarukoTech describes several malicious contracts which were created against different protocols and that "[t]he attacker seems to be generating similar addresses to well know[n] protocols"[25].
June 23rd, 2022 3:54:00 PM MDT Bret Woods Suggestion Twitter user Bret Woods (@fewture) posts that "[w]e're seeing hackers create addresses that match the first 4 and last 4 characters". His suggestion is to run the same transaction with "the gas SUPER LOW. Like 5 gwei. Your transaction won't go through, but it will populate on @etherscan where it is much easier to click through and make sure it's doing what you intended to do"[26].
June 23rd, 2022 4:46:00 PM MDT Convex Finance DNS Hijack Post Similarly affected Convex Finance first posts on Twitter to announce the DNS hijacking. They list 5 addresses which are affected, that investigation is still ongoing, and that the issue is "remediated" for their service[27][23].
June 24th, 2022 5:48:00 AM MDT DeFi Saver Reports Exploit The Defi Saver team publicly acknowledges the incident on Twitter and state that they believe no users were affected[28]. They make clear that "strong passwords and 2fa were used and [they] don't recogni[z]e security factors on our end that could have led to this"[11]. Users are requested to verify "on every transaction" that "all token approvals that [they] give at DeFi Saver [are] to [their] DSProxy (smart wallet)"[29].
June 24th, 2022 6:00:00 AM MDT Telegram Group Operating A Telegram group has reportedly been set up for communication and coordination between the different affected protocols[30].
June 24th, 2022 6:14:00 AM MDT All Attacks Reported Together All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA[13].
June 24th, 2022 7:00:00 AM MDT Attacks Reported With Screenshots Twitter user Nalin Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread[31].
June 24th, 2022 7:24:00 AM MDT Speculation About Further Domains Further speculation arises that some other domains may be related[32]. The list referenced are cryptocurrency phishing websites and it does not appear that any of those domains are related to the DNS attack[33].
June 24th, 2022 7:29:00 AM MDT Attacks Reported Together Again Twitter user Tommy Famous also reports on all 4 DNS attacks in a single thread[34].
June 24th, 2022 8:34:00 AM DefiSaver Reports DNS Migration DefiSaver reports that they have migrated away from NameCheap as their domain registrar[35].
June 24th, 2022 10:01:00 AM MDT NameCheap Response NameCheap's CEO responds on Twitter that they've "traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."[36]
June 24th, 2022 10:03:00 AM MDT Free DomainVault Monitoring NameCheap's CEO expands the original tweet to say that they "would like to offer [affected services their] Domain Vault service for free and [they] will also place all affected domains on the highest security monitoring"[37].
June 24th, 2022 10:32:00 AM MDT Nothing To Worry About NameCheap assures via Twitter that "[t]here is nothing to worry about" and they will "keep investigating"[38].
June 24th, 2022 11:21:00 AM MDT NameCheap DomainVault "Usually we require a pin code from customer. We also monitor all actions as well a monitor a real time vip list. In the end our [customer support] needs to be able to modify to help customers especially when 99% don't understand [DNS]. If you want complete security use [DomainVault]"[39]
June 24th, 2022 4:16:00 PM MDT NameCheap Clarifies Hack NameCheap responds that it "[l]ooks more like [their customer support] person was hacked."[9]
June 24th, 2022 5:26:00 PM MDT DefiSaver Again Confirms Migration DefiSaver again confirms that they have migrated away from NameCheap for their DNS[40].
June 25th, 2022 Domain Vault Discount NameCheap lowers the price of their Domain Vault service from $19.88/mo[41] to $1.88/mo[42].
July 2nd, 2022 Price Segmentation NameCheap decides to offer two different Domain Vault services from "Silver" tier at $1.88/mo[43] to "Titanium" tier at $19.88/mo[44].

Technical Details

Blockchain Analytics

Various notable addresses and transactions from Etherscan for further research/analysis:

[45][46][47][48][49][50][51][52][53]

Total Amount Lost

According to Defi Saver's "knowledge and analysis", none of their users were affected. This suggests that the attackers were not successful in taking any funds in this particular case[28].

Immediate Reactions

A Telegram group was set up for communication between the different affected protocols[54].

Defi Saver reported the attack on Twitter the following day[28]:

We experienced an attempted DNS attack on http://DeFiSaver.com yeste[r]day.

Based on our knowledge and analysis, no users were affected in any way.

The common denominator with @ConvexFinance and @RibbonFinance was @Namecheap and we invite other projects to exercise caution.

Twitter user @psyOPs_ accused the team of not using two-factor authentication[55] and the team provided clarification that they were using 2FA[56].

hi. namecheap user here. no issues. no news of any data breaches. suspect real common denominator here was accounts not using 2FA security.

We certainly did use 2FA, as mentioned and as did other teams. Is there a reason why you would expect your domain to be targe[t]ed in this kind of attack, i.e. is it a domain of a defi protocol which is the other common denominator in this case?

Both DefiSaver[35] and Twitter user 0xPooka confirmed they are switching away from NameCheap[57].

Just switched all my domains from Namecheap to AWS Route 53 the other day. Took 15 minutes

Ultimate Outcome

It does not appear that any funds were lost and DNS was successfully restored[28].

The NameCheap CEO ultimately responded on Twitter to explain that there was a hacked or compromised customer support agent and all access was removed from them[58]. He also offered completely free Domain Vault monitoring to all affected services[59].

"We've traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating." "In the meantime we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring."

DefiSaver is no longer using NameCheap as their domain registrar[35][40].

Total Amount Recovered

While funds were lost on other targeted platforms, based on a report by DeFiSaver, there do not appear to have been any funds lost from their platform[28].

Ongoing Developments

DNS was successfully restored and there do not appear to be any remaining developments in this case.

Individual Prevention Policies

There are two policies which apply in this case. See the Prevention Policies for Individuals page for the full list.

Full Prevention

Every approval on Web3 is an opportunity to lose all of the funds present in your wallet. Take the time to review the transaction in full. Fully check over the balance, permissions, and entire address which you are interacting with. Do not trust that your clipboard or any website front-end is guaranteed to provide an accurate address or transaction status. Always perform a test transaction prior to the first high-value transaction in any session.

Limiting Losses

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

Platform Prevention Policies

There are three different policies applying here. See the Prevention Policies for Platforms page for all policies.

Prevention by Namecheap

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

The issue ultimately stemmed from a single customer support agent being compromised. A multi-signature requirement on DNS changes would have prevented this scenario entirely. While NameCheap offers advanced protections on their domain names, this service had just launched two days prior to the DNS change, so it was unlikely to be a reasonable expectation that Convex Finance would have already signed up.

Prevention by DeFi Saver

All points along the communication and supply chain should be inspected for vulnerabilities. Common vulnerability points may include DNS, Discord, and customer information. What steps are required to access and/or modify the component? Do any third party companies or organizations implement a proper multi-signature approach? What additional security options are available?

Regulatory Prevention Policies

There is one policy to prevent the situation, and one to reduce the impact. See the Prevention Policies for Regulators page for the full list of policies.

Full Prevention Through Security Assessments

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Reduction Through Education

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

This could greatly reduce the effectiveness of a similar fraud to affect those such educated.

References

  1. 1.0 1.1 DeFi Saver - Crypto Project Reviews. What is DeFi Saver? - DefiPrime (Feb 7, 2023)
  2. 2.0 2.1 2.2 2.3 2.4 2.5 DeFi Saver Homepage (Jul 24, 2021)
  3. Introduction - DeFi Saver Docs (Feb 7, 2023)
  4. What is DNS? | How DNS works | Cloudflare (Feb 9, 2023)
  5. Post Mortem Of Events June 23 (Aug 24, 2022)
  6. Convex Finance - "Another update on recent events: - Incident involved a customer support agent being compromised at Namecheap, leading to DNS hijack of multiple defi platform front-ends. - Original http://convexfinance.com domain is back to normal operation. DNS is secured and actively monitored." - Twitter (Aug 24, 2022)
  7. Devan Collins - "NameCheap hosts the site and does not run it. But there are rogue NameCheap employees ignoring abuse requests for these sites. They advertise on OGUsers. I have sent all findings to Brian Krebs. And I have evidence reporting the scam weeks ago and tickets being closed." - Twitter (Aug 24, 2022)
  8. LefterisJP - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack. @ConvexFinance @ribbonfinance @DeFiSaver and Allbridge. They are all using @Namecheap and logged into their accounts to see DNS changed. So far namecheap has provided no explanation." - Twitter (Feb 10, 2023)
  9. 9.0 9.1 Richard Kirkendall - "[l]ooks more like [their customer support] person was hacked." - Twitter (Feb 11, 2023)
  10. DeFi Dapps DNS Attacked - TrustNodes (Feb 25, 2024)
  11. 11.0 11.1 DeFiSaver - "Same as with others, strong passwords and 2fa were used and we don't recognise security factors on our end that could have led to this." - Twitter (Mar 23, 2023)
  12. DefiSaver - "We certainly did use 2FA, as mentioned and as did other teams." - Twitter (Mar 23, 2023)
  13. 13.0 13.1 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter (Apr 1, 2023)
  14. Domain Vault Page on Mar 22nd, 2022 - Namecheap (Feb 9, 2023)
  15. 15.0 15.1 First Transaction Creating Malicious Contract 0x65a8...3b2f - Etherscan (Feb 23, 2023)
  16. Unused Contract 0x65a8...3b2f - Etherscan (Feb 27, 2023)
  17. Wallet Address 0x5622...7d1a Who Created 0x65a8...3b2f - Etherscan (Feb 27, 2023)
  18. Domain Vault Page on June 19th, 2022 - Namecheap (Feb 12, 2023)
  19. Domain Vault Page on June 20th, 2022 - Namecheap (Feb 12, 2023)
  20. Final Malicious Contract Creation - EtherScan (Feb 23, 2023)
  21. Alexintosh - "What is this unverified contract?" - Twitter (Aug 23, 2022)
  22. Contract Addresses - ConvexFinance (Aug 24, 2022)
  23. 23.0 23.1 Convex: more info on the hack - Cryptonomist (Jul 2, 2022)
  24. Convex Finance - "Please review approvals while we evaluate a potential front end issue." - Twitter (Aug 23, 2022)
  25. HarukoTech - "[t]he attacker seems to be generating similar addresses to well know[n] protocols" - Twitter (Aug 24, 2022)
  26. Bret Woods (@fewture) - "[w]e're seeing hackers create addresses that match the first 4 and last 4 characters" - Twitter (Feb 22, 2023)
  27. Convex Finance - "Investigation is still ongoing, but...5 addresses seem to have approved malicious contracts" - Twitter (Aug 24, 2022)
  28. 28.0 28.1 28.2 28.3 28.4 DefiSaver - "Based on our knowledge and analysis, no users were affected in any way." - Twitter (Feb 22, 2023)
  29. DefiSaver - "all token approvals that you give at DeFi Saver should be to your DSProxy (smart wallet) - please do verify that on every transaction" - Twitter (Mar 23, 2023)
  30. 0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter (Feb 27, 2023)
  31. Nalin Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter (Apr 1, 2023)
  32. Nalin Gupta - "It does seem some others might be affected tho[ugh]" - Twitter (Apr 1, 2023)
  33. idclickthat - "crypto phish" - Twitter (Apr 1, 2023)
  34. TommyBeFamous - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack." - Twitter (Mar 24, 2023)
  35. 35.0 35.1 35.2 DefiSaver - "PSA: We have already migrated from Namecheap." - Twitter (Apr 1, 2023)
  36. Richard Kirkendall - "traced this down to a specific [customer support] agent that was either hacked or compromised" - Twitter (Aug 24, 2022)
  37. Richard Kirkendall - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter (Feb 24, 2023)
  38. NameCheap - "There is nothing to worry about; we keep investigating" - Twitter (Apr 1, 2023)
  39. Richard Kirkendall - "If you want complete security use [Domain Vault]" - Twitter (Aug 24, 2022)
  40. 40.0 40.1 DefiSaver - "this was immediately resolved and we quickly migrated away from Namecheap, too" - Twitter (Apr 1, 2023)
  41. Domain Vault Page on June 24th, 2022 - Namecheap (Feb 13, 2023)
  42. Domain Vault Page on June 25th, 2022 - Namecheap (Feb 13, 2023)
  43. Domain Vault Page on July 1st, 2022 - Namecheap (Feb 13, 2023)
  44. Domain Vault Page on July 2nd, 2022 - Namecheap (Feb 13, 2023)
  45. Unused Contract 0x65a8...3b2f - Etherscan (Feb 27, 2023)
  46. Transaction Creating Contract 0x65a8...3b2f - Etherscan (Feb 27, 2023)
  47. Wallet Address 0x5622...7d1a Who Created 0x65a8...3b2f - Etherscan (Feb 27, 2023)
  48. Transaction Creating 0xdd49....c82b - Etherscan (Feb 27, 2023)
  49. Transactions By Wallet 0x56d3...49c8 (Fake_Phishing5851) - Etherscan (Dec 27, 2023)
  50. Address 0x4e12...899a Who Created 0xf403...ae31 - Etherscan (Dec 28, 2023)
  51. Vanity Phishing Smart Contract 0xF403...AE31 - Etherscan (Dec 7, 2o23)
  52. Address 0xB732...F9Aa (Convex & Ribbon Phisher) - Etherscan (Aug 23, 2022)
  53. Convex Finance Tokens Received By Convex & Ribbon Phisher - Etherscan (Dec 28, 2023)
  54. @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter (Feb 27, 2023)
  55. psyOPs_ Accusation - Twitter (Feb 22, 2023)
  56. DefiSaver "We certainly did use 2FA" - Twitter (Feb 22, 2023)
  57. 0xPooka - "Just switched all my domains from Namecheap" - Twitter (Feb 22, 2023)
  58. @NamecheapCEO - "traced this down to a specific [customer support] agent that was either hacked or compromised" - Twitter (Aug 24, 2022)
  59. @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter (Feb 24, 2023)