TL;DR#
On February 07, 2023, an attacker exploited CoW Swap protocol to siphon off approximately $166,500 in funds.
Introduction to CoW Protocol#
The CoW Protocol powers a network of traders and solvers to enable trustless and efficient peer-to-peer trading by utilizing batch auctions.
Vulnerability Assessment#
The vulnerability occurred because the exploiter was able to utilize a vulnerability in the token authorization process in order to transfer DAI from the GPv2Settlement contract via the SwapGuard contract.
Steps#
Step 1:
The attacker duped the owner of the GPv2Settlement contract into authorizing the use of the SwapGuard.
Step 2:
SwapGuard is a contract that CoW Swap used to help and validate swap results. It also supports arbitrary function calls, which means that anyone with access to the contract can invoke any function call within its code. The earlier authorization might have contributed to the success of the attack.
Step 3:
The contract deployed by the attacker enabled anyone to use approval in transferring from the settlement contract to an arbitrary address.
Step 4:
The Barter solver made an error of approving the malicious contract with the maximum amount of DAI to SwapGuard.
Step 5:
As a result, the attacker was able to call the public function and transfer DAI to their address.
Step 6:
The team stated that the hacker knew how the CoW Swap solver worked because the alleged hacker waited until the last day of the fee accrual period (every Tuesday) to carry out the attack.
Aftermath#
Following the incident, the team acknowledged its occurrence and stated that they had mitigated the problem and were investigating its cause.
The CoW Swap team revoked all approvals for the affected contract and upgraded to a new contract that did not support arbitrary code execution.
They further asserted that none of the user's funds were at risk. The team also shared a detailed post mortem report of the incident.
Solution#
A contract with the interface of arbitrary call should not include any allowances in order to mitigate from attacks of this kind.
We may not have prevented the occurrence of this hack, however the impact or aftermath of this attack could have been significantly reduced if CoW Protocol had set up a dedicated cover pool in the Neptune Mutual marketplace. We offer coverage to users who have suffered a loss of funds or digital assets occurring as a result of smart contract vulnerabilities owing to our parametric policies.
Users who purchase the available parametric cover policies do not need to provide loss evidence in order to receive payouts. Payouts can be claimed as soon as an incident is resolved through the incident resolution system. At the moment, our marketplace is available on two popular blockchain networks, Ethereum, and Arbitrum.
Neptune Mutual's security team would also have evaluated the platform for DNS and web-based security, frontend and backend security, intrusion detection and prevention, and other security considerations.
Reference Sources CoW Protocol, BlockSec
