Introduction
2022 was a bad year for DeFi Security. 82% of all cryptocurrency assets stolen last year were stolen from DeFi platforms, totalling over $3.1 billion.
DeFi has grown rapidly over the past few years, and that growth has attracted hackers, who are always looking for vulnerabilities to exploit. HYDN is a blockchain security firm specializing in Real-time Fraud Prevention, Smart Contract Audits, and Web3 Penetration Testing.
This article covers five common types of attack on DeFi platforms and why they are so risky, and then explains how HYDN Prevent, our real-time fraud prevention product, can help protect your platform from them.
The big five: common attacks on DeFi platforms
Smart contract vulnerabilities
DeFi platforms run on smart contracts, and poorly written contracts give hackers plenty to work with. Reentrancy attacks, integer overflows and front-running attacks are just a few examples of vulnerabilities that can be exploited to drain funds or destabilize a platform. Even well written code which has been audited can still turn up vulnerabilities that were missed by an audit firm, so just relying on audits isn’t enough.
Oracle manipulation
Not all attacks on DeFi platforms look like traditional hacking. In some cases, malicious actors have drained funds from DeFi protocols without exploiting a flaw in the platform’s code. They manipulated the price oracles that DeFi platforms rely on to price assets in line with the wider cryptocurrency market. These are oracle manipulation attacks.
Bad actors typically carry them out by using substantial amounts of cryptocurrency to rapidly increase the trading volume of low-liquidity tokens on the targeted DeFi platform. This can cause swift, significant price surges that don’t reflect the wider market. If attackers don’t have the capital to hand, they often get the initial funds through flash loans. Once they’ve driven up the asset’s price, they can exchange their artificially inflated holdings for more liquid tokens with stable values, or use the overvalued tokens as collateral to borrow other assets, with no intention of repaying the loan.
This type of attack can result in significant losses or even the collapse of the entire platform. Chainalysis estimated that in 2022, DeFi protocols lost $403.2 million in 41 separate oracle manipulation attacks.
Phishing and social engineering attacks
Phishing is still a tried and tested method for hackers, who use deception to coax users into revealing sensitive information. That information can then be used to access and steal funds from the victim’s wallet or DeFi account.
In a phishing attack, a malicious actor creates a fake website or app that looks similar to a legitimate DeFi platform, and then tricks users into providing their login credentials or other sensitive information. Once the attacker has access to a user’s account, they can transfer funds out of it or take other actions that cost the user money.
Sybil attacks
In a Sybil attack, an attacker creates a large number of fake user accounts and uses them to manipulate the system. The fake accounts can be used for spamming the network, manipulating voting systems, and financial attacks such as flash loans and liquidity draining attacks.
In DeFi, Sybil attacks can be particularly damaging because they can be used to manipulate voting in governance protocols. That can let the attacker take control of the protocol and make decisions that benefit them at the expense of other users. Sybil attacks can also be used to manipulate the price of tokens and assets by creating artificial demand, which leads to losses for legitimate investors.
Flash loan attacks
Flash loans have become increasingly popular in DeFi. They allow users to borrow funds without any collateral, as long as they repay the loan in the same transaction. Flash loans have enabled new DeFi use cases and financial products, and they have also introduced a new attack vector.
In a flash loan attack, an attacker borrows a large amount of funds through a flash loan and uses it to manipulate the price of a DeFi asset. The attacker can then use the manipulated price to make a profit on another DeFi platform, such as by buying a low-priced asset on one platform and selling it for a higher price on another. Once the attacker makes a profit, they repay the flash loan, leaving no collateral or obligation to repay the funds.
One example occurred in February 2021 on the DeFi platform PancakeBunny. The attacker borrowed a large amount of funds through a flash loan and used them to manipulate the price of BUNNY, the platform’s native token. By manipulating the price, the attacker was able to withdraw a large amount of liquidity from PancakeBunny’s BUNNY-BNB pool, causing the price to drop significantly. This allowed the attacker to buy back BUNNY at a lower price and repay the flash loan, earning a significant profit in the process.
Flash loan attacks can be devastating for DeFi platforms. They cause significant financial losses and undermine user trust in the platform. They can also have a ripple effect, because manipulating one asset can affect the price of other assets in the platform’s ecosystem. And they are difficult to prevent, since they are often executed through complex techniques that exploit vulnerabilities in the DeFi smart contracts.
Understanding the risks
Decentralization cuts both ways for DeFi platforms. It removes intermediaries and reduces fees for users. It also puts the responsibility for security on dApp owners and developers. With millions of dollars at stake and a growing number of DeFi platforms, hackers have plenty of motivation to target the industry.
Smart contract audits and Web3 penetration testing
The first line of defense against DeFi attacks is a thorough smart contract audit. DeFi platforms that identify and fix vulnerabilities before deployment significantly reduce the risk of hacks. HYDN’s smart contract audits draw on our extensive experience working with leading DeFi projects, such as SushiSwap, SpookySwap, and Sablier.
Web3 penetration testing simulates real-world attack scenarios to identify weaknesses in your platform’s infrastructure. HYDN’s Web3 penetration testing experts will help you uncover and remediate vulnerabilities before they can be exploited.
Real-time fraud prevention for DeFi with HYDN Prevent
Audits and penetration testing are essential, but DeFi attacks change quickly, and blockchain security needs to be proactive as well as reactive. The logical answer is real-time fraud prevention for dApps.
That is where HYDN Prevent comes in.
Currently the blockchain security market features a number of products focused on Monitoring and Alerting, but these usually result in reactive security measures being taken. That is, a project is alerted that an attack is either taking place or about to take place and by the time they can react it is too late. HYDN has gone a step further by building the HYDN Prevent execution engine, which proactively stops threats where competing products only detect and alert.
HYDN Prevent is our real-time fraud prevention product for DeFi. It analyzes every transaction that interacts with your dApp’s smart contracts, identifying and blocking malicious ones, with no impact on the user journey of legitimate users. It has over 100 detectors covering common attack vectors such as Reentrancy Attacks, Oracle Manipulation, Phishing Attempts, Contract Impersonation, Role Changes, and more, so it can detect and prevent almost all attacks in real time, saving your dApp millions.
We have made integrating HYDN Prevent as simple as possible with a 5-minute integration all that is required.
HYDN Prevent protects your DeFi dApp’s assets and reputation even when it is under attack.
If you’d like more information about HYDN Prevent or would like to sign up to the service head to our sign-up page now.
