TL;DR#
On September 20, 2022, Wintermute's CEO announced on Twitter that the protocol had lost $160 million due to DeFi hacking attacks.
Introduction to Wintermute#
Wintermute is a global cryptocurrency market maker and algorithmic trading firm that offers liquidity across a variety of vetted exchanges, trading platforms, and coins.
Vulnerability Assessment#
The root cause of the attack is due to a vulnerability in Profanity, an Ethereum vanity address tool, which allowed for the disclosure of a private key. The attacker made use of this information to execute a privilege function and designate the swap contract as the attacker-controlled one.
Steps#
Step 1:
The attack began with a transaction request, in which Wintermute's hot wallet called their vault contract in order to transfer tokens to the hacker's contract.
Step 2:
The vault only allows admin to perform these transfers, and with Wintermute’s hot wallet serving as admin, it is expected that the admin address itself was likely compromised.
Step 3:
The admin address is a vanity address that was possibly generated using Profanity. 1inch team had publicly disclosed a critical bug in Profanity a few days before this incident.
Step 4:
Following this disclosure, Wintermute removed all ether from their admin address, indicating the team's acknowledgement of a potential vulnerability. However, they failed to remove the address as an admin from their vault. Due to an internal error, a wrong function was called and the team blacklisted the router instead of the operator, i.e., the contract that signs.
Step 5:
The attacker funded this address with their own ether and then used it to pull off the heist by exploiting the bug in Profanity to recover the hot wallet's private key.
Step 6:
Thus this hacker created a helper contract, deposited stable coin into Curve to avoid blacklisting, and figured out the vulnerability in a closed sourced vault contract. The hacker's wallet now contains approximately $9 million in Ether (ETH) and $37.5 million in other ERC-20 tokens.
Aftermath#
The hacker transferred $111 million to Curve Finance's 3pool to prevent Tether and Circle from freezing stablecoins. Despite the incident, Wintermute's lending and OTC operations have not been affected. Evgeny Gaevoy, the company's founder and CEO, stated that the company remains solvent, with more than twice the value of the stolen funds in equity remaining.
When the news of lost assets hit the market, on-chain data revealed that the team owes more than $200 million in DeFi debt to a number of counterparties. The biggest debt is a $92 million USDT loan from TrueFi, followed by a $75 million USDC and WETH debt to Maple Finance and a $22.4 million USDT debt to Clearpool.
How to prevent such an attack vector#
The majority of exploits are the result of human error. DeFi institutions should invest enough resources in automating processes to test the protocol in order to reduce the human impact of such serious circumstances.
Our security team at Neptune Mutual can validate your platform for DNS and web-based security, smart contract reviews, as well as frontend and backend security. We can offer you a solution to scan your platform and safeguard your protocol for known and unknown vulnerabilities that have the potential to have catastrophic long-term effects. Contact us on social media if you are serious about security and have the budget, desire, and feeling of responsibility to do so.
