Sending WETH To WETH Contract Mistake

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Wrapped Ethereum Graphics

Reddit user basubadelmevt read an online guide to the wrapped ethereum (WETH) protocol which was part of the Binance Academy, which lead him to believe he could send wrapped ethereum to the wrapped ethereum smart contract, and it would work to unwrap it as implied by the guide. Instead, their wrapped ethereum (worth over $500,000 USD) was permanently lost. After the incident received widespread attention, they deleted their Reddit account.

About basubadelmevt

basubadelmevt originally joined Reddit in October 2014.

About Wrapped Ethereum

Wrapped ethereum is a smart contract which creates an ERC20 token representing ethereum. The ERC20 token interface creates compatibility, allowing wrapped ethereum tokens to be traded directly against other ERC20 tokens. Wrapped ethereum tokens are minted by depositing ethereum into the smart contract, and can be later redeemed for the underlying ethereum.

Binance Academy Tutorial

According to the Binance tutorial on Wrapped Ethereum, WETH can be redeemed by sending the tokens back to the smart contract.

Wrapped Ether (WETH) refers to the ERC-20 compatible version of ether (wrapping ether with other ERC standards is also possible). WETH can be created by sending ether to a smart contract where the ether is placed on hold, in turn receiving the WETH ERC-20 token at a 1:1 ratio. This WETH can afterward be sent back into the same smart contract to be “unwrapped” or redeemed back for the original ether at a 1:1 ratio.

The Reality

Sending wrapped ethereum to the WETH smart contract does not result in any redemption being triggered. Instead, senders do not receive any Ethereum. The immutable wrapped ethereum smart contract does not contain any function providing the capability to retrieve tokens which were sent to the smart contract by mistake. This means that funds which are sent to the WETH smart contract are permanently lost.

What Happened

basubadelmevt sent wrapped ethereum to the wrapped ethereum smart contract, expecting that it would be converted to ethereum. However, this was not the case and instead they permanently lost their funds.

Key Event Timeline - Sending WETH To WETH Contract Mistake

Date	Event	Description
January 29th, 2022 7:37:50 PM MST	Blockchain Transaction	The actual initial blockchain transaction is performed, which sends 195.222590391470037218 wrapped ethereum to the wrapped ethereum smart contract. The end result of this transaction is that the wrapped ethereum is sitting in the wrapped ethereum smart contract's address.
January 29th, 2022 8:01:46 PM MST	Original Reddit Post	The incident is first posted to Reddit by basubadelmevt. There is just a link to the transaction.
January 30th, 2022 9:04:30 PM MST	Incident Crossposted	The incident is crossposted to the /r/SorryForYourLoss subreddit.
January 31st, 2022 1:38:02 AM MST	Reddit Post Deleted	The original Reddit post was deleted sometime prior to the start of January 31st.
January 31st, 2022 6:59:58 AM MST	Clarification Of Story	basubadelmevt posts on Reddit to clarify that they were "tricked into sending WETH to this contract because of Binance's website" and links to a specific Binance Academy article quoting that "WETH can afterward be sent back into the same smart contract to be “unwrapped” or redeemed back for the original ether at a 1:1 ratio". "I can completely sympathize with view that these mistakes can occur and we should do something about it as a community. I love this community and I want to see less people suffer from such mistakes."
January 31st, 2022 12:11:58 PM MST	CryptoPotato Article Published	The story is reported on by CryptoPotato.
February 2nd, 2022	Repost To IFunny	The Reddit post is shared to IFunny, with specific commentary on the concern over the perception of cryptocurrencies.

Technical Details

The misconception has been directly attributed to a Binance Academy article. basubadelmevt reports that this article gave them the impression that sending WETH to the WETH smart contract could result in redemption. They had previously sent ethereum to the WETH smart contract, which works to receive wrapped ethereum. In addition, they validated the address in the MetaMask wallet was the correction WETH smart contract.

"Edit: Full story. Sent ETH to WETH contract and got WETH back (after some googling I found this is how the contract works). Assumed it works the same way backwards and sent WETH back to the contract. No ETH back. Apparently you have to use a frontend to get the ETH back. ETH lost forever."

Confusion From Binance Academy Article

basubadelmevt describes how they came to the mistaken conclusion that WETH could be unwrapped by sending to the Wrapped Ethereum smart contract.

WETH.io indeed confused me with the lack of guidance, but I was tricked into sending WETH to this contract because of Binance's website.

`Wrapped Ether (WETH) refers to the ERC-20 compatible version of ether (wrapping ether with other ERC standards is also possible). WETH can be created by sending ether to a smart contract where the ether is placed on hold, in turn receiving the WETH ERC-20 token at a 1:1 ratio. This WETH can afterward be sent back into the same smart contract to be “unwrapped” or redeemed back for the original ether at a 1:1 ratio.` from https://academy.binance.com/en/glossary/wrapped-ether

and when I put the address to MetaMask it immediately recognized it giving me a false sense of security.

Blockchain Transaction

The blockchain transaction involved is at block 14104487 of the Ethereum blockchain, occurring on January 30th at 2:37:50 AM UTC.

The transaction sends 195.222590391470037218 wrapped ethereum from basubadelmevt's wallet to the wrapped ethereum smart contract, where the wrapped ethereum permanently sits.

Total Amount Lost

Web3isGoingGreat estimated the loss at $510,000 USD.

The total amount lost has been estimated at $510,000 USD.

Immediate Reactions

"I am sharing my wallet address in case the community wants to help me remediate some of this loss. I would also be in favor of an EIP returning money to addresses who lost money because of these early mistakes. However, I can see that this can be a contentious one, so the community and the success of Ethereum should always be first."

Thanks From Original Poster

basubadelmevt modified their original post to thank others in the community.

"Edit 2: Thanks strangers. I am really happy to see lots of kind hearted people in the comments and chat. This is a significant amount of money for anyone to lose and it was the case for me as well. I was under the stress of some other things in my life and made a bigger mistake by making assumptions in this wild early technology. But, I will be OK."

Ultimate Outcome

Further clarity was provided on Reddit that basubadelmevt remains a strong supporter of cryptocurrencies and how they got the wrong idea of the operation of the wrapped ethereum smart contract.

Concern Over Negative Cryptocurrency Perception

The original reporter basubadelmevt expressed concerns over the negative perception to cryptocurrencies that their experience and report may create.

"Edit 3: I am also sorry that this was a negative event for the perception of cryptocurrencies. The last thing I would want in this world :( A life-changing lesson for me, but definitely something to work on as a community as well."

Clarification and Further Reddit Posting

WETH.io indeed confused me with the lack of guidance, but I was tricked into sending WETH to this contract because of Binance's website.

I can completely sympathize with view that these mistakes can occur and we should do something about it as a community. I love this community and I want to see less people suffer from such mistakes.

Deletion of Reddit Account

basubadelmevt ultimately deleted their Reddit account.

Total Amount Recovered

Recovery is theoretically possible through an Ethereum Improvement Proposal, however this would likely be contentious. It would involve modifying the Ethereum protocol to create an exception where funds can be released for a single smart contract. This does not seem likely to occur. basubadelmevt expressed their thoughts on the matter.

I would also be in favor of an EIP returning money to addresses who lost money because of these early mistakes. However, I can see that this can be a contentious one, so the community and the success of Ethereum should always be first."

Ongoing Developments

There have been some requests to change the content of the wrapped ethereum article on Binance or to modify the Ethereum blockchain to allow the return of trapped funds, however nothing has been approved yet.

Continued Mistakes Being Made

As of April 6th, 2023, the wrapped ethereum smart contract presently holds 654.29451014 wrapped ethereum, all of which is permanently lost.

Binance Academy Tutorial Still Misleading

The Binance Academy tutorial continues to feature the misleading information that "WETH can afterward be sent back into the same smart contract to be “unwrapped” or redeemed back for the original ether at a 1:1 ratio."

Individual Prevention Policies

The primary issue was that the transaction did not perform the expected function. The situation could have been avoided through further research. Losses could have been massively reduced by testing with a smaller amount of funds prior to transferring the full amount, or eliminated by testing a similar transaction on a testnet. There are also a number of similar transactions which can be viewed on the blockchain.

Every approval on Web3 is an opportunity to lose all of the funds present in your wallet. Take the time to review the transaction in full. Fully check over the balance, permissions, and entire address which you are interacting with. Do not trust that your clipboard or any website front-end is guaranteed to provide an accurate address or transaction status. Always perform a test transaction prior to the first high-value transaction in any session.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

This situation came about partially due to misleading information in the Binance academy. Ensuring that all information is up to data and providing further education about the risks of transactions and the need to perform test transactions may prevent similar situations.

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

The wrapped ethereum smart contract did not include any method for retrieving tokens stuck in the contract. This could potentially have been uncovered and flagged as part of a review during initial development..

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

An industry insurance fund could assist in the event of loss.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Greater education can prevent this issue, or at least teach users to test transactions with smaller amounts. The blockchain also provides a number of tools such as testnets to test without any funds as stake, which many users may not be aware of.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

An industry insurance fund could assist in some events. They may be able to provide more immediate relief than other strategies.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.