Qubit Finance Platform Deposit Hack

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Qubit Finance

Qubit Finance is a decentralized lending platform. Late on January 27th, an attacker brought funds from tornadocash and used them to exploit the smart contract hot wallet, creating a fake deposit and then withdrawing 206,809 Binance coins from the hot wallet. The platform has pledge to continue tracking the funds, and so far the attacker has not made an effort to move them from their wallet. However, given that their source of funds came from TornadoCash, it's unlikely they could be identified unless they attempt to cash out the funds without going through TornadoCash again. A bounty was offered but the attacker has not yet responded.

This is a global/international case not involving a specific country.

About Qubit Finance

"Qubit is a decentralized money market platform that takes advantage of the speed, automation, and security of the blockchain to connect lenders and borrowers efficiently and securely."

"Users of Qubit Finance can participate as lenders and borrowers. Lender: As a liquidity provider, lenders can deposit assets to lend out to others. Liquidity providers will earn interest on their deposited assets. Borrower: A borrower can deposit assets as collateral and borrow assets in return."

"At Qubit, we are committed to making money markets a secure commodity for the entire BSC Ecosystem. Consequently, Qubit does not charge the withdrawal fees that have hindered the innovative applications of more sophisticated leveraged strategies on the BSC."

"Qubit is also explicitly committed to furthering ecosystem security on the BSC. Qubit does this in two ways. First, Qubit does not support flash loans, which eliminates from the platform one of the greatest sources of insecurity in the entire ecosystem."

"Second, Team Qubit will fully support vertically integrated code review and full-stack audits for all whitelisted projects that build on the Qubit platform. This represents a significant but necessary ecosystem investment by Qubit in order to eliminate the vulnerabilities that were injected into the BSC ecosystem by the uncoordinated migrations that interrupted and disrupted many projects this past May."

The Reality

Bridges are often targets of exploits because they typically involve the automatic minting of assets, usually in real-time. If an adversary can simply fool the software into believing that they made a deposit, then they can often receive assets of the bridge directly without having to make a payment.

Blockchain researchers at CertiK report that an attacker exploited Qubit Finance's Ethereum-BSC bridge, resulting in a loss of $80 million. The attacker used a logical error in Qubit Finance's code to input malicious data and withdraw tokens on the Binance Smart Chain without depositing any on Ethereum. Despite fail-safes, the attacker successfully invoked the deposit function with malicious input data but actually deposited zero ETH. The vulnerability was partly due to the fact that tokenAddress.safeTransferFrom() did not revert when the tokenAddress was the null address. There were also two other code logic errors discovered in the smart contract. The incident emphasizes the importance of secure cross-chain bridges for interoperability between blockchains. As the cryptocurrency landscape becomes more multi-chain, it is crucial to ensure the security of these bridges to prevent significant losses due to exploitation.

The Record by Recorded Future reports that Qubit Finance, a decentralized finance (DeFi) platform, was hacked, resulting in the theft of around $80 million worth of cryptocurrency. The attack involved exploiting a vulnerability in one of Qubit's Ethereum blockchain contracts, allowing the attacker to steal 206,809 Binance coins (BNB) from the platform's wallet. The stolen funds remain in the attacker's possession and have not been laundered. Qubit has attempted to recover the funds by offering the hacker a bug bounty reward through a private message and a public message on Twitter. If the hacker does not return the funds, this hack will be one of the largest recorded hacks of a DeFi platform. The attack on Qubit is part of a trend where bridge projects, used for token transfers between blockchains, have become targets for hackers.

What Happened

The Ethereum-BSC bridge was hacked for $80m through fooling the bridge into believing that the funds had been deposited.

Key Event Timeline - Qubit Finance Platform Deposit Hack

Date	Event	Description
January 27th, 2022 2:34:00 PM MST	Exploit Attack Started	"At 9:34PM UTC on January 27th, 2022, an attacker began their exploit of Qubit Finance’s Ethereum-BSC bridge."
January 27th, 2022 3:19:00 PM MST	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
January 28th, 2022 7:15:55 AM MST	Article Published By The Record	The Record by Recorded Future reports that Qubit Finance, a decentralized finance (DeFi) platform, was hacked, resulting in the theft of around $80 million worth of cryptocurrency. The attack involved exploiting a vulnerability in one of Qubit's Ethereum blockchain contracts, allowing the attacker to steal 206,809 Binance coins (BNB) from the platform's wallet. The stolen funds remain in the attacker's possession and have not been laundered. Qubit has attempted to recover the funds by offering the hacker a bug bounty reward through a private message and a public message on Twitter. If the hacker does not return the funds, this hack will be one of the largest recorded hacks of a DeFi platform. The attack on Qubit is part of a trend where bridge projects, used for token transfers between blockchains, have become targets for hackers.
January 28th, 2022 11:37:22 AM MST	CertiK Medium Article Published	Blockchain researchers at CertiK report that an attacker exploited Qubit Finance's Ethereum-BSC bridge, resulting in a loss of $80 million. The attacker used a logical error in Qubit Finance's code to input malicious data and withdraw tokens on the Binance Smart Chain without depositing any on Ethereum. Despite fail-safes, the attacker successfully invoked the deposit function with malicious input data but actually deposited zero ETH. The vulnerability was partly due to the fact that tokenAddress.safeTransferFrom() did not revert when the tokenAddress was the null address. There were also two other code logic errors discovered in the smart contract. The incident emphasizes the importance of secure cross-chain bridges for interoperability between blockchains. As the cryptocurrency landscape becomes more multi-chain, it is crucial to ensure the security of these bridges to prevent significant losses due to exploitation.
January 28th, 2022 3:29:50 PM MST	BankInfoSecurity Article Published	BankInfoSecurity reports that decentralized finance (DeFi) platform Qubit Finance has been hacked for over $80 million in what is considered the largest DeFi hack of 2022 and the seventh-largest exploit on record. The hack targeted Qubit Finance, which operates on the Binance Smart Chain, and resulted in the theft of 206,809 Binance Coin. The hacker exploited a logical error in Qubit Finance's code to withdraw tokens on the Binance Smart Chain despite no deposits being made on Ethereum. The attack highlights the importance of cross-chain bridges for interoperability between blockchains and the need for their security. CertiK, a blockchain security firm, emphasizes the adversarial nature of the DeFi markets and the importance of platforms evolving to protect against known threats. Concerns around hacking and regulation in the cryptocurrency space continue to grow, with policymakers considering comprehensive regulations to address volatility and security risks. The focus on crypto security is expected to extend to interoperability in the coming year..

Technical Details

Blockchain researchers at CertiK report that an attacker exploited Qubit Finance's Ethereum-BSC bridge, resulting in a loss of $80 million. The attacker used a logical error in Qubit Finance's code to input malicious data and withdraw tokens on the Binance Smart Chain without depositing any on Ethereum. Despite fail-safes, the attacker successfully invoked the deposit function with malicious input data but actually deposited zero ETH. The vulnerability was partly due to the fact that tokenAddress.safeTransferFrom() did not revert when the tokenAddress was the null address. There were also two other code logic errors discovered in the smart contract. The incident emphasizes the importance of secure cross-chain bridges for interoperability between blockchains. As the cryptocurrency landscape becomes more multi-chain, it is crucial to ensure the security of these bridges to prevent significant losses due to exploitation.

"At 9:34PM UTC on January 27th, 2022, an attacker began their exploit of Qubit Finance’s Ethereum-BSC bridge."

"The attacker called the QBridge deposit function on the ethereum network, which calls the deposit function QBridgeHandler. QBridgeHandler should receive the WETH token, which is the original tokenAddress, and if the person who performed the tx does not have a WETH token, the transfer should not occur," the company explained.

"In summary, the deposit function was a function that should not be used after depositETH was newly developed, but it remained in the contract. The team is cooperating with security and network partners, including Binance. Supply, Redeem, Borrow, Repay, Bridge, and Bridge redemption functions are disabled until further notice. Claiming is available. We are continuing to investigate and are in communications with Binance."

"Blockchain security and data analytics company PeckShield has revealed that the reason for the hack is to create an immense amount of xETH (xplosive Ethereum) collateral. xETH provides a wallet service for secret transactions and brings more privacy to ETH payments. The hackers have created the scheme to drain the whole BNB stored on QBridge."

"Moreover, CertiK, a blockchain security firm, pointed out that the deposit option in QBridge was prone to hackers with which they illegally minted 77,162 qXETH assets in Qubit. Rekt database informed that hackers have used such fraudulent activities several times to convert all the hacked assets to BNB, making it the seventh-largest exploit in DeFi."

"According to blockchain security firm CertiK, the hackers took advantage of a logical error in Qubit Finance’s code. The DeFi platform said the smart contract software bug allowed the hacker to transfer about 206,809 Binance coins worth about $80 million after depositing 0 ETH."

"This exploit ended up netting them 77,162 qXETH ($185 million), which they then used to borrow and convert 15,688 wETH ($37.6 million), 767 BTC-B ($28.5 million), approximately $9.5 million in various stablecoins, and ~$5 million in CAKE, BUNNY, and MDX."

"“The attacker called the ‘deposit()’ function in the QBridge contract without any ETH attached in this transaction,” CertiK wrote."

"The attacker injected malicious data, and the deposit logic failed to invoke a function to verify the data injected. The report noted that the ‘tokenAddress.safeTransferFrom()’ fails to revert when the ‘tokenAddress’ parameter is zero."

"The researchers also discovered two more logical errors that attackers could exploit. One flaw could allow an attacker to deposit ETH and ERC20 tokens using the same event."

Total Amount Lost

The total amount lost has been estimated at $79,845,000 USD.

Immediate Reactions

"In a conversation today, Tal Be’ery, CTO at cryptocurrency wallet app ZenGo, has also pointed out that Qubit’s hack is part of a larger trend in the cryptocurrency industry."

“Recently a few bridge projects were hacked: Polychain MATIC, Multichain and now Qubit,” Be’ery said.

“Bridge projects, ‘moving’ tokens and coins from one blockchain to another, seem to be more vulnerable to attacks as they don’t move the tokens themselves, but instead use a deposit function to exchange the coin to some internal representation, and do their internal cross-chain accounting with this representation,” he added.

“If there is an error there, the attacker can ‘print’ money in the internal representation and then withdraw it for ‘real’ money,” Be’ery said, explaining the base mechanism behind the hacker’s exploit and how they managed to steal Qubit’s funds.

"Qubit finance said it was tracking the hacker and working with security networks and Binance. Additionally, the DeFi platform disabled the Redeem, Borrow, Repay, Bridge, and Bridge redemption functionalities indefinitely."

"The DeFi platform has also identified the attacker’s address and confirmed that the assets were still in the accounts. Qubit opened an opportunity for negotiations imploring the attacker to engage the company for a negotiable maximum bounty offer."

Ultimate Outcome

"Later, the company disclosed that the attacker had swapped all the stolen assets into a single ETH wallet. Qubit promised to commit resources to solve the issue and expressed its willingness to compensate the victims."

"Qubit has asked the hacker to return the funds, so far to no avail." "As of the time of publication, the attacker’s address still holds approximately $80 million of stolen assets."

"Lastly, our willingness to compensate. As early innovators in the DeFi space, our goal is to continue our work. In light of this event, we are committed to developing a means to compensate members of the community who have been affected by this attack."

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

TBD

Individual Prevention Policies

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

The Qubit Bridge vulnerability could potentially have been uncovered through additional validation by experts.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

The amount of funds at risk on new platforms can be massively reduced by storing most funds in a multi-signature treasury during development. Funds remain secure against breach in the multi-signature wallet and can be released to the smart contract as necessary to handle a shortage of liquidity.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

An industry insurance fund can assist with selecting validators and assist in the event of a breach.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.