What lessons can the Poly Network theft incident have for Polkadot, which focuses on cross-chain?
Produced by the Polkadot Ecological Research Institute, it must be a boutique (the article is very long, it is recommended to collect it first and then read it)
background
Produced by the Polkadot Ecological Research Institute, it must be a boutique (the article is very long, it is recommended to collect it first and then read it)
background
Although the Poly Network hacking incident is coming to an end, and news has spread in the past two days, the blockchain cross-chain platform Poly Network, considering that the hacker has returned most of the stolen digital assets, decided not to pursue its legal responsibility, and even Invite him to serve as the company's chief security consultant to assist Poly Network in providing assistance in subsequent security matters.
So far, as the largest theft case in the DeFi field (more than 600 million US dollars was stolen), it has gone down the "hot news" in a relatively harmonious way. Looking around, the incident is also considered to be the largest theft in the field of encrypted assets in history, surpassing the previously recorded $534.8 million stolen from the Japanese Coincheck exchange (2018).
Looking back at this incident, the more interesting point is that in the early morning of August 13, the hacker of the Poly Network theft announced his mental journey on the Ethereum network. He wrote in his self-question: "Why did you choose to attack Poly?" Network? Because the recent cross-chain protocol attacks are very 'hot'."
So the story goes back to a word that has attracted much attention in 2020-cross-chain.
Cross-chain attacks are hot?
We can’t help but wonder, are cross-chain attacks really popular, or is this hacker’s joke?
According to PeckShield statistics, as of August 12, a total of 19 DeFi security incidents occurred in the third quarter (Q3) of 2021, with an average of 1 security incident occurring in two days, with a total loss of 677 million US dollars. In terms of quantity, the security incidents that occurred on Ethereum and cross-chain protocols did top the list, reaching 6 cases respectively.
Of course, PeckShield’s statistics are only for the third quarter. If you zoom in, there is still a lot of reference value. After all, we can intuitively find that since the beginning of this year, with the popularity of DeFi, the stolen amount in this field has been growing rapidly According to incomplete statistics, in the past six months, on average, one theft in the DeFi field has occurred every month, and the amount of loss has already exceeded tens of millions of dollars, but the theft of Poly Network has increased this figure.
The reason why the cross-chain field has been targeted by many hackers is that since the popularity of Layer2 and sidechains, the second-layer network led by the Polygon network has started a rapid lock-up growth, breaking through $100 million in a short period of time. The $1 billion or even $5 billion mark, facing such a big cake, naturally attracted the attention of many hackers.
Another point, as the co-founder of BlockSec said, "The entire process of the cross-chain bridge is relatively complicated, involving the interaction between multiple chains and multiple contracts, and the monitoring of these security risks requires the overall security of the cross-chain bridge. Assessment and analysis. The audit and analysis of a certain module cannot fully cover the security risks of the entire link.”
Through the above analysis, it is not difficult to find that for cross-chain sweets, on the one hand, there is a huge amount of lock-up, on the other hand, it is full of complicated processes, there are many risk points, and a very high security awareness is required , This is why hackers say that "cross-chain protocol attacks are very 'hot'". After all, it is not only a challenge for them, but also a "fruit" that some hackers covet.
Of course, before exploring cross-chain attacks, let’s take the theft of Poly Network as an example to dismantle the reasons why cross-chain protocols were targeted and how did cross-chain protocol attacks happen? (The following content will inevitably involve some technical analysis, we try to explain it to you in plain language for easy understanding)
Review PolyNetwork Events
As the largest hacking incident in the history of DeFi development, Poly Network has sounded the alarm for both project parties and ordinary users, how to protect our assets in the rapidly developing blockchain field, and make the entire ecology better and safer , requires everyone's unremitting efforts. At the moment, let us review and analyze the Poly Network incident first, so as to have a clearer understanding of the incident, not just blind anxiety and panic.
1. The cause of the event and the result
The attack first occurred at 17:55 on August 10. Hackers transferred assets worth more than 260 million U.S. dollars from Poly Network’s smart contracts on the Ethereum chain, 96.38 million USDC and 1032 WBTC respectively. However, the attack did not end. At 18:04, the hacker transferred 85.08 million USDC from the smart contract on Polygon, and at 18:08, the hacker transferred 87.6 million USDC and 26,629 ETH from the smart contract on BSC. So far, hackers have stolen $610 million worth of digital assets.
Afterwards, before 13:00 on August 11, the hacker moved part of the funds on BSC and Ethereum, respectively adding the liquidity of 32.1 million BUSD and 87.6 million USDC on BSC worth 120 million US dollars to the In the Curve fork project Ellipsis Finance. And the liquidity of more than 97.06 million US dollars on Ethereum, including 670,000 DAI and 96.38 million USDC, was added to Curve, and then the liquidity was withdrawn and converted into 96.94 million DAI.
At the same time, an address of hanashiro.eth reminded him that Thether had frozen the USDT on its Ethereum through the hacker's address. In order to express his gratitude, the hacker transferred 13.37 ETH representing the hacker word "Leet" to the address. While showing off their hacking skills, the hacker attracted the participation of some people, and some users sent chain information to the hacker’s address in order to get rewards.
After a short period of discussion, Poly Network called on peer organizations to blacklist hacker addresses and publicly called out hackers, whose behavior is against the law in any country. In the end, after many efforts and the consideration of multiple factors by the hacker himself, the hacker began to gradually return the funds at around 17:00 on August 11, including 1,010,100 USDC on the polygon, 23.99 PBTC on the BSC, SHIB and FEI on the Ethereum wait.
Then at 22:00, BUSD ETH and BTC worth 253 million US dollars on the BSC chain were returned; at 23:30, the assets on the Ethereum were returned; and at 9:00 on August 12, all Polygon and BSC on the BSC were returned assets. At present, except for the frozen assets, basically all have been returned.
So does this represent a hacker's compromise? The hacker released a high-profile self-question and self-answer in the Ethereum transaction information, publicly stating that in the DeFi world, you cannot trust anyone except the code and yourself. And everything he does is for the safety of community user funds. He just stayed in the dark to save the world. The choice of Poly Network is just because cross-chain attacks are currently very popular, he is just for fun.
Whether seeking money or fame, there is no doubt that this hacker did it, and this shocking case will be recorded in the annals of blockchain history. However, whether this represents the unreliability of cross-chain related protocols, the author believes that in any type of early project development, some flaws will inevitably appear. As pioneers, they need to cross the river by feeling the stones, and bumps and bumps in this process are inevitable. We cannot completely distrust cross-chain related agreements because of temporary setbacks, and give up eating because of choking. In general, as a heterogeneous cross-chain field, Poly Network, which first solves technical difficulties such as large differences in algorithms and underlying architectures between blockchains, low execution speed of cross-chain information interaction, and information insecurity, still has its value.
So why such a problem occurs, and how to modify and avoid it in a timely and effective manner has become a topic of greatest concern to everyone. How exactly do hackers do it? At present, there is an image metaphor circulating on the Internet, "The hacker took the owner's certificate to find the property to get the key. The proof was false, but he got the real key from the property."
So let's briefly analyze further.
2. Hacking techniques and event summary
To understand hackers' methods, we need to take a look at the architecture of Poly Network. The architecture of Poly Network is divided into three parts: SRC chain (source chain), Poly chain, and DST chain (target chain). Simply speaking, after the cross-chain transaction initiated by the source chain is confirmed, RelayerA will synchronize the block header information to Poly chain , and then Poly chain synchronizes the blockchain information to the target chain RelayerB, and the target chain RelayerB transfers the verification information to the target chain for verification and execution of the transaction.
In such an architecture, the role of Relayer is very important. The hacker seized the loophole in the smart contract, modified the keeper of the EthCrossChainData contract through the EthCrossChainManager contract, and then used the verifyHeaderAndExecuteTx function of the EthCrossChainManager contract to steal funds through the _executeCrossChainTx function.
To put it simply, the unchecked attack transaction initialized by the hacker on the source chain is included in the Merkle tree by RelayerA and signed. The hacker uses the valid Merkle certificate and then uses RelayerB to change the keeper to a public transaction controlled by the hacker. key, and then steal the funds.
The reason is that the Merkle proof of RelayerB does not verify whether the information it has received has been destroyed or modified. Any user can call the verifyHeaderAndExecuteTx function to execute the transaction, and the user name can be called when calling inside it. At the same time, the permission to modify the Keeper in the EthCrossChainManager contract enables hackers to modify the Keeper through abnormal data calls and sign transactions. There is no doubt that this is a problem in the contract authority management logic.
And this also sounded the alarm for Poly Network and similar related protocols. The project party seems to need to polish more carefully in the verification of cross-chain transaction events and the design of contract authority management.
Inspiration for Polkadot
1. What will happen to Polkadot in the face of cross-chain attacks?
In fact, from the point of view of hackers’ methods for this cross-chain attack, the main problem of PolyNetwork this time is that the component that acts as a relay in the cross-chain function has defects in the verification of cross-chain messages on the chain, and the limitation of contract permissions. There is a problem with the management logic, which allows hackers to receive malicious cross-chain messages and perform the operations specified by the cross-chain messages on the corresponding chain.
The reason why such a problem arises is that the cross-chain will involve the interaction of different contracts between different chains, and the complexity suddenly rises. Based on the characteristics of the blockchain itself, the security of most public chains is relatively guaranteed, but once it involves sending information from one chain to another chain, how the information is transmitted between different chains, this process is not clear. The characteristics of the blockchain itself serve as a security guarantee. Therefore, in order to prevent risks in this process, the designed mechanisms and processes are often more complicated, and there are more risk points. This is like a bank vault itself with a high safety factor, but when transferring assets between two banks, since the process cannot obtain the same security as a vault, complex procedures and the deployment of cash trucks and security personnel are often used. But this gives criminals many opportunities to rob, and cross-chains also face similar problems.
So, will Polkadot, known as the king of cross-chains, have similar problems?
In fact, from this incident, we can notice that cross-chain problems are often caused by heterogeneous cross-chains, that is, between blockchains with different architectures. The basic structure of Polkadot is the architecture of relay chain + parachain, and the architecture of parachains has a common source, which is the Substrate framework. Therefore, the parachain is a part of Polkadot, and the information transmission between Polkadot's parachains belongs to the isomorphic cross-chain, which is equivalent to Polkadot's own function, which is realized directly by XCMP (cross-chain information transfer). So you won't have the same problem.
However, for Polkadot to use the transfer bridge to link blockchains of different architectures to Polkadot, that is, for the case of heterogeneous cross-chains, there are still problems, which lies in the security of the transfer bridge. The transfer bridge is not a unique problem. For example, not only the Polkadot official is working with the Snowfork team to build a transfer bridge from Ethereum to Polkadot, but also other Polkadot parachains are doing Ethereum transfer bridges. There is also no provision to agree on how many transfer bridges there can be, or which one is the only one to be recognized, because in essence, whether the transfer bridge or Layer 2 is in a chain Live assets, and then issue shadow assets in another chain. Since it is a matter of smart contracts, many transfer bridges can be made, so there is no limit to the number of transfer bridges.
To sum up, for the problem of cross-chain attacks, although Polkadot will conduct strict code audits at every step, code audits cannot fully guarantee that no special situations will occur. For example, Poly Network has already undergone code audits. , is still hacked. However, at least some common problems will not appear in the project after the code audit, which can be regarded as an added insurance. In addition, for Polkadot, due to its technical architecture, the information transmission between its parachains and parachains is an isomorphic cross-chain, which is a function of Polkadot, and relatively speaking, the security will be higher , the risk points are much less, but we still have to wait for the actual test. For Polkadot, the core issue is the security of the transfer bridge, because the transfer bridge is a heterogeneous cross-chain link, so this is also the place where Polkadot ecology is most likely to be attacked by cross-chains. Therefore, we cannot say that Polkadot can completely avoid the occurrence of cross-chain attacks.
2. How to correctly view the cross-chain attack problem Polkadot faces
So how should we correctly view the cross-chain attack problem Polkadot faces?
Leaving aside the blockchain, when we zoom in to the entire computer field, there is no concept of absolute security. Some just design the difficulty of doing evil to be very difficult to achieve, but there is relative security. Back to the blockchain, blockchains with a PoW consensus mechanism like Bitcoin are not completely safe, because there is the concept of 51% computing power attacks. In fact, in recent years, many projects such as ETC and BitcoinGold have been hacked 51% computing power has been attacked. In terms of smart contracts, Ethereum, a representative of smart contracts, also suffered a big loss on The DAO due to contract loopholes.
However, Ethereum did not fall because of this. Instead, it became stronger and stronger, becoming one of the most popular blockchain projects at the moment. Some projects that have experienced hacking incidents have not recovered after a setback. All the impact of hacking attacks has been wiped out by various means, the vulnerabilities have been repaired, and the project has been revived and continued to advance.
Therefore, we cannot perfectly expect that Polkadot will not encounter this kind of thing, but we should clearly understand that such a thing is hard to guard against. If we really encounter it, we should find a way to actively solve it. There is always a solution. After the solution is resolved, the project can be further improved. As long as the project itself develops well, it will reach a higher height, which is exactly the case with Ethereum.
3. Solutions
In fact, we don't have to worry too much about hacker attacks. With the frequent occurrence of hacker attacks, we are already familiar with how to deal with these problems. There are two main categories of methods.
First, it is solved purely on the chain, and it is handled in a governance or centralized way. For example, the project party freezes stolen assets through governance methods such as voting, or cooperates with centralized stablecoin providers to allow them to freeze assets; Fork a new chain and new assets, and transfer the old assets to the new chain based on the data obtained from the snapshot, etc. These processing methods are relatively common solutions, and there are successful cases in actual operation, which are worth learning from.
The second is the way that the on-chain and off-chain forces cooperate with each other to recover assets. This time, Poly Network used on-chain and off-chain resources to put pressure on the hackers, and then recovered all the lost money. And another case of StableMagnet Finance, which happened in June this year, was finally detected by the British police through a combination of on-chain and off-chain methods, and all stolen assets have been recovered. It reconnects with the rightful owner. The victim of this case can contact the police to deal with it, and needs to provide relevant information, including wallet address and proof of possession, etc., and finally return the assets in the chain.
Therefore, as the regulation of cryptocurrencies in various countries is gradually strengthened, cryptocurrency exchanges will have higher and higher requirements for KYC. The clues on the chain combined with the law enforcement off the chain will make many hackers discouraged or arrested.
In short, through the existing solutions, the impact of the hacking incident can be solved relatively satisfactorily, so you don’t need to mind too much.
4. Suggestions to all Polkadot ecological stakeholders
So, for participants in the Polkadot ecosystem, what should we pay attention to?
For applications or project parties in the Polkadot ecosystem, since smart contracts are involved in accidents, it is necessary to learn from the experience of past security incidents to avoid making the same mistakes. At the same time, security audits must be indispensable. But on the other hand, it is also necessary to explore some new solutions. For example, Celer Network, a Layer 2 expansion platform in the Polkadot ecosystem, has launched a non-contractual liquidity locking method like cBridge. Or make the project less decentralized, and use some centralized mechanisms to make the product more suitable for some professional scenarios. For example, Aave launched the Aave Pro product for institutional users. By adding a whitelist system, only KYC participants are allowed to access the Aave Pro pool , so as to shield the perpetrators and protect the safety of funds.
postscript
For participants who invest funds to participate in these cross-chain projects, they must do enough investigations to participate in any project, especially before investing a lot, try to choose projects with perfect audit status and long running time, and for some authorized You must pay more attention to your behavior, and don't agree to some very high-level authorizations at will. We must be cautious about applications with heterogeneous cross-chains in the ecology, and do not try it lightly without sufficient investigation and preparation. In addition, try to find an endorsement from a well-known institution as much as possible, and it will be easier to hold accountable if there is a problem.
postscript
Pay attention to the official account
*The information provided by the Polkadot Ecological Research Institute does not represent any investment hints. The published articles only represent personal opinions and are for reference only. Since there are no policies and regulations related to digital assets in China, users in mainland China are requested to pay close attention to the development of Crypto.
In view of the endless emergence of Polkadot ecological projects, but the inferior projects and scam projects are full of them, it is worthy of vigilance. On the other hand, it is difficult for groups only on the Polkadot project side to understand the whole picture of the entire ecological development of Polkadot, and miss many opportunities. Therefore, we decided to establish a Polkadot ecological group, which can openly discuss all Polkadot ecological projects. Everyone can objectively share their views on each project, understand the development of each Polkadot project, and exchange information to seize opportunities together.
Pay attention to the official account"Polkadot Ecological Research Institute", Reply to "Join the group", you can talk about Polkadot with many fans.
