Sending WETH To WETH Contract Mistake

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Wrapped Ethereum Graphics

Reddit user basubadelmevt read an online guide to the wrapped ethereum (WETH) protocol which was part of the Binance Academy, which lead him to believe he could send wrapped ethereum to the wrapped ethereum smart contract, and it would work to unwrap it as implied by the guide. Without testing their assumptions with a small amount of funds or on a testnet, they sent their wrapped ethereum to the smart contract. Instead of receiving unwrapped ethereum, their wrapped ethereum (worth over $500,000 USD) was permanently lost. After the incident received widespread attention, they deleted their Reddit account.

About basubadelmevt

basubadelmevt originally joined Reddit in October 2014. They were an active investor in Curve, Avalanche, DAI. They had recently been discussing DAI protocol challenges maintaining it's peg.

I agree things are gonna work out in the long term. But, quoting my not-so-favorite economist Keynes, in the long run we are all dead.

In case of DAI, all the risk is visible. That's why we are having these conversations, because the potential risk is visible to everyone. In case of centralized stable coins, you have the false sense of security but actually the risks are more invisible. It's more insidious in that sense.

About Wrapped Ethereum

Wrapped Ethereum (wETH) is an ERC-20 compatible version of ETH, designed to facilitate the exchange of Ether for ERC-20 tokens and vice versa, addressing the interoperability gap between Ether and ERC-20 tokens. Wrapped tokens, like wETH, represent the same value as their underlying assets but adhere to ERC-20 standards. The process of wrapping Ether involves sending ETH to a smart contract, which generates wETH, and the reverse process of unwrapping can be done by sending wETH to a smart contract. While wETH cannot be used for gas fees on the Ethereum network, it opens up investment and staking opportunities on decentralized applications (DApps) and can be utilized on platforms like OpenSea for auctions.

Binance Academy Tutorial

According to the Binance tutorial on Wrapped Ethereum, WETH can be redeemed by sending the tokens back to the smart contract.

Wrapped Ether (WETH) refers to the ERC-20 compatible version of ether (wrapping ether with other ERC standards is also possible). WETH can be created by sending ether to a smart contract where the ether is placed on hold, in turn receiving the WETH ERC-20 token at a 1:1 ratio. This WETH can afterward be sent back into the same smart contract to be “unwrapped” or redeemed back for the original ether at a 1:1 ratio.

The Reality

Sending wrapped ethereum to the WETH smart contract does not result in any redemption being triggered. Instead, senders do not receive any Ethereum. The immutable wrapped ethereum smart contract does not contain any function providing the capability to retrieve tokens which were sent to the smart contract by mistake. This means that funds which are sent to the WETH smart contract are permanently lost.

Despite the current role of wrapped tokens, there are concerns about centralization and a push toward achieving better interoperability between blockchains, potentially eliminating the need for wrapped tokens like wETH in the future.

What Happened

basubadelmevt sent wrapped ethereum to the wrapped ethereum smart contract, expecting that it would be converted to ethereum. However, this was not the case and instead they permanently lost their funds.

Key Event Timeline - Sending WETH To WETH Contract Mistake

Date	Event	Description
January 29th, 2022 7:37:50 PM MST	Blockchain Transaction	The actual initial blockchain transaction is performed, which sends 195.222590391470037218 wrapped ethereum to the wrapped ethereum smart contract. The end result of this transaction is that the wrapped ethereum is sitting in the wrapped ethereum smart contract's address.
January 29th, 2022 8:01:46 PM MST	Original Reddit Post	The incident is first posted to Reddit by basubadelmevt. There is just a link to the transaction.
January 30th, 2022 9:04:30 PM MST	Incident Crossposted	The incident is crossposted to the /r/SorryForYourLoss subreddit.
January 31st, 2022 1:38:02 AM MST	Reddit Post Deleted	The original Reddit post was deleted sometime prior to the start of January 31st.
January 31st, 2022 6:59:58 AM MST	Clarification Of Story	basubadelmevt posts on Reddit to clarify that they were "tricked into sending WETH to this contract because of Binance's website" and links to a specific Binance Academy article quoting that "WETH can afterward be sent back into the same smart contract to be “unwrapped” or redeemed back for the original ether at a 1:1 ratio". "I can completely sympathize with view that these mistakes can occur and we should do something about it as a community. I love this community and I want to see less people suffer from such mistakes."
January 31st, 2022 12:11:58 PM MST	CryptoPotato Article Published	The story is reported on by CryptoPotato. They report that the mistake sparked discussions on security and user experience within the Ethereum community. The trader, who held WETH for years, realized the irreversible error, prompting concerns about the ease of such mistakes hindering Ethereum's mainstream adoption. Some proposed solutions included implementing warnings or blocking transfers to the problematic address. Unlike traditional systems, the decentralized nature of blockchain means recovery options are limited, and the contentious history of Ethereum hard forks adds complexity to potential solutions. The incident sheds light on the risks associated with using wrapped versions of cryptocurrencies on different blockchains, with the report suggesting that Ethereum developers are working on making ETH compliant with the ERC-20 standard to prevent similar errors in the future.
February 2nd, 2022	Repost To IFunny	The Reddit post is shared to IFunny, with specific commentary on the concern over the perception of cryptocurrencies.

Technical Details

The misconception has been directly attributed to a Binance Academy article. basubadelmevt reports that this article gave them the impression that sending WETH to the WETH smart contract could result in redemption. They had previously sent ethereum to the WETH smart contract, which works to receive wrapped ethereum. In addition, they validated the address in the MetaMask wallet was the correction WETH smart contract.

"Edit: Full story. Sent ETH to WETH contract and got WETH back (after some googling I found this is how the contract works). Assumed it works the same way backwards and sent WETH back to the contract. No ETH back. Apparently you have to use a frontend to get the ETH back. ETH lost forever."

Confusion From Binance Academy Article

basubadelmevt describes how they came to the mistaken conclusion that WETH could be unwrapped by sending to the Wrapped Ethereum smart contract.

WETH.io indeed confused me with the lack of guidance, but I was tricked into sending WETH to this contract because of Binance's website.

`Wrapped Ether (WETH) refers to the ERC-20 compatible version of ether (wrapping ether with other ERC standards is also possible). WETH can be created by sending ether to a smart contract where the ether is placed on hold, in turn receiving the WETH ERC-20 token at a 1:1 ratio. This WETH can afterward be sent back into the same smart contract to be “unwrapped” or redeemed back for the original ether at a 1:1 ratio.` from https://academy.binance.com/en/glossary/wrapped-ether

and when I put the address to MetaMask it immediately recognized it giving me a false sense of security.

Blockchain Transaction

The blockchain transaction involved is at block 14104487 of the Ethereum blockchain, occurring on January 30th at 2:37:50 AM UTC.

The transaction sends 195.222590391470037218 wrapped ethereum from basubadelmevt's wallet to the wrapped ethereum smart contract, where the wrapped ethereum permanently sits.

Total Amount Lost

Web3isGoingGreat estimated the loss at $510,000 USD.

The total amount lost has been estimated at $510,000 USD.

Immediate Reactions

"I am sharing my wallet address in case the community wants to help me remediate some of this loss. I would also be in favor of an EIP returning money to addresses who lost money because of these early mistakes. However, I can see that this can be a contentious one, so the community and the success of Ethereum should always be first."

Thanks From Original Poster

basubadelmevt modified their original post to thank others in the community.

"Edit 2: Thanks strangers. I am really happy to see lots of kind hearted people in the comments and chat. This is a significant amount of money for anyone to lose and it was the case for me as well. I was under the stress of some other things in my life and made a bigger mistake by making assumptions in this wild early technology. But, I will be OK."

Ultimate Outcome

Further clarity was provided on Reddit that basubadelmevt remains a strong supporter of cryptocurrencies and how they got the wrong idea of the operation of the wrapped ethereum smart contract.

Concern Over Negative Cryptocurrency Perception

The original reporter basubadelmevt expressed concerns over the negative perception to cryptocurrencies that their experience and report may create.

"Edit 3: I am also sorry that this was a negative event for the perception of cryptocurrencies. The last thing I would want in this world :( A life-changing lesson for me, but definitely something to work on as a community as well."

Clarification and Further Reddit Posting

basubadelmevt provided further clarification on how they became confused over the process.

WETH.io indeed confused me with the lack of guidance, but I was tricked into sending WETH to this contract because of Binance's website.

I can completely sympathize with view that these mistakes can occur and we should do something about it as a community. I love this community and I want to see less people suffer from such mistakes.

Deletion of Reddit Account

basubadelmevt ultimately deleted their Reddit account.

Other Community Reactions

Reddit user Darkcryptomoon, themselves a victim of a previous con, posted a response and recommended trying chains other than Ethereum.

We are basically getting the cons of a decentralized system without really getting all the benefits.

I appreciate the transparency of blockchains. I also appreciate transactions without fees and a chain with customer support. There are chains that have those, believe it or not. You don't have to settle with Ethereum. The fees alone should open people's eyes more. But you keep dying on that hill man.

Total Amount Recovered

Recovery is theoretically possible through an Ethereum Improvement Proposal, however this would likely be contentious. It would involve modifying the Ethereum protocol to create an exception where funds can be released for a single smart contract. This does not seem likely to occur. basubadelmevt expressed their thoughts on the matter.

I would also be in favor of an EIP returning money to addresses who lost money because of these early mistakes. However, I can see that this can be a contentious one, so the community and the success of Ethereum should always be first."

Ongoing Developments

There have been some requests to change the content of the wrapped ethereum article on Binance or to modify the Ethereum blockchain to allow the return of trapped funds, however nothing has been approved yet.

Continued Mistakes Being Made

As of April 6th, 2023, the wrapped ethereum smart contract presently holds 654.29451014 wrapped ethereum, all of which is permanently lost.

Binance Academy Tutorial Still Misleading

The Binance Academy tutorial continues to feature the misleading information that "WETH can afterward be sent back into the same smart contract to be “unwrapped” or redeemed back for the original ether at a 1:1 ratio."

Pushes For Warnings or Transfer Blocks

Some members of the community have proposed solutions included implementing warnings or blocking transfers to the problematic address. Unlike traditional systems, the decentralized nature of blockchain means recovery options are limited, and the contentious history of Ethereum hard forks adds complexity to potential solutions.

Standardizing ERC20 Versus Ethereum

Reports suggested that Ethereum developers are working on making ETH compliant with the ERC-20 standard to prevent similar errors in the future. Such changes would make wrapped ethereum obsolete and unnecessary.

Individual Prevention Policies

The primary issue was that the transaction did not perform the expected function. The situation could have been avoided through further research. Losses could have been massively reduced by testing with a smaller amount of funds prior to transferring the full amount, or eliminated by testing a similar transaction on a testnet. There are also a number of similar transactions which can be viewed on the blockchain.

Every approval on Web3 is an opportunity to lose all of the funds present in your wallet. Take the time to review the transaction in full. Fully check over the balance, permissions, and entire address which you are interacting with. Do not trust that your clipboard or any website front-end is guaranteed to provide an accurate address or transaction status. Always perform a test transaction prior to the first high-value transaction in any session.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

This situation came about partially due to misleading information in the Binance academy. Ensuring that all information is up to data and providing further education about the risks of transactions and the need to perform test transactions may prevent similar situations.

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

The wrapped ethereum smart contract did not include any method for retrieving tokens stuck in the contract. This could potentially have been uncovered and flagged as part of a review during initial development..

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

An industry insurance fund could assist in the event of loss.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Greater education can prevent this issue, or at least teach users to test transactions with smaller amounts. The blockchain also provides a number of tools such as testnets to test without any funds as stake, which many users may not be aware of.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

An industry insurance fund could assist in some events. They may be able to provide more immediate relief than other strategies.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.