Velvet Capital Front-End Incident

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Velvet Capital Logo/Homepage

Velvet Capital offers infrastructure to help with adoption of DeFi infrastructure, with a suite of tools specifically targeted against several key pain points which they identified from surveying professional investors and traders. On April 22nd, 2024, it was reported that their front-end had been attacked and users who attempted to use their product were being prompted to approve a malicious smart contract. Fortunately, no funds were actually lost, and the application was brought back online quickly. Details about the vulnerabilities in the front-end do not appear to have ever been disclosed, however the user interface was also upgraded within a couple of weeks of the incident.

This is a global/international case not involving a specific country.

About Velvet Capital

"Intent Operating System for Seamless DeFi"

"We expect ~$8-19T in assets (both web3-native & real-world) to be on-chain in the near future. There’s a strong need to use on-chain financial rails to manage these assets, and many professional investors & traders are already exploring DeFi." "While DeFi infrastructure is maturing across the board, it still lacks the comprehensive, institutional-grade tooling that is suitable for professional investors & traders."

"Velvet.Capital is an Intent Operating System for DeFi that helps manage your onchain portfolio or launch new DeFi products." "Bringing together the latest research & development in intent-based architecture & account abstraction, Velvet.Capital is working with traders & portfolio managers to remove barriers for DeFi adoption."

"Velvet’s intent-based architecture and integrations with major aggregators, solvers & market makers enable smart routing across on-chain sources (AMMs and DEXes) as well as other OTC-style venues to ensure the best execution & MEV protection."

"One-click allocation into DeFi pools to earn additional yield from lending, staking, or providing liquidity batches all necessary actions (e.g., trading, token approval, staking, minting) together so that you can seamlessly go from any token/pool to any token/pool (or rebalance the whole portfolio in one click)."

"An API layer with end-point structure similar to well-known CEXes helps seamlessly use existing trading algorithms or create new ones automating on-chain interactions. "

"Every vault is deployed on-chain with its own series of smart contracts and access controls: users can deposit to / withdraw from the vault by minting/burning LP tokens, and vault managers can execute their strategies without having custody over the underlying assets. While every vault is non-custodial by default, the protocol architecture also allows to set up multi-sig vaults (and MPCs in the future versions) for large clients separating custody from asset management functionality (reach out to the team to learn more)."

"Functionality to whitelist wallets able to access the vault (e.g., allow only clients who went through KYC/KYB), restrict transfers and limit permitted assets and protocols. There’s a separate admin role which can be used to manage these processes without access to trading."

"Velvet is the first DeFi protocol aimed to provide omni-chain asset management capabilities, so that vault managers are not constrained within a single chain and can execute complex strategies across multiple ecosystems (will be introduced in future versions)."

"Velvet is partnering with on-chain derivative protocols & borrowing functionality to broaden the asset management toolkit on Velvet and allow to run delta-neutral strategies (coming in the future versions)."

"Velvet's flexible architecture & permissioning capabilities make the protocol suitable for real-world assets tokenization, and the first RWA product on Velvet is currently in private beta (reach out to the team to join the pilot)."

"All the contracts are open for external code auditors / white hats to verify the code. We're constantly running bug bounties and conducting security audits. The latest audits perfomed by Peckshield and Shellboxes"

"Users reported abnormal activity on the trading platform of the DeFi asset management protocol Velvet Capital on April 23rd. When attempting to connect to the frontend, users were prompted to approve their wallet's access permissions for the protocol."

"ATTN: Some of the users experienced an issue while connecting to the app today, please don't interact with Velvet front-end, we're closing it for maintenance & investigating the issue."

"No known users were impacted, if you interacted with Velvet on April 23 after 12:30am UTC and believe you were impacted - please create a ticket on Discord.

The team promptly identified the issue and, together with top security researchers, investigated the malicious activity & the issue is being fixed.

The smart contracts are not affected and the issue occurred on the front-end, therefore if you did not interact and sign the malicious transaction your funds are safe." "No funds lost - thanks to those who alerted and our security team + others who assisted"

"The app is back up & running, and users can once again manage their vaults on Velvet Capital"

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Velvet Capital Front-End Incident

Date	Event	Description
April 22nd, 2024 10:11:00 PM MDT	Initial Tweet Posted	The incident is posted about on Twitter by Velvet Capital.
April 22nd, 2024 10:57:00 PM MDT	Tweet Revision	The Velvet Capital team returns to Twitter to fix a typo where they asked users not to "interact with the Velvet" instead of the Velvet front-end.
April 23rd, 2024 2:34:00 AM MDT	No Users Were Affected	The Velvet Capital team reports that they don't believe any users were impacts, and users can create a ticket on Discord if they believe they were. The issue occurred on the front-end, and as long as users did not interact, they would be safe. They will provide an update onece the website is safe to use again.
April 23rd, 2024 7:31:00 AM MDT	Back Up And Running	The Velvet Capital team announces that their application is back up and running now.
April 23rd, 2024 7:33:00 AM MDT	No Funds Lost	Michael Hage, who works with the protocol, reports that no funds were lost in the attack, and thanks those who took the time to report it. This would serve as a confirmation that no one has reported losses since the original update.
April 25th, 2024 6:58:00 PM MDT	Safe Protocol Integration	Velvet Capital explains how their protocol integrates with the Safe Protocol to create vaults in a tweet.
May 1st, 2024 11:45:00 AM MDT	New User Interface	Velvet Capital announces their new user interface, as a promotion where users can expect 3x the TVL points and 6x the normal mining rewards.
May 10th, 2024 3:38:00 PM MDT	More On INterface	Velvet Captital releases more information ont he newly upgraded interface.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

No funds were lost.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.