Another Hack In the DeFi Community – the Wormhole DeFi Hack

Wormhole DeFi recently got hacked and suffered a major hack where hackers stole $320 million in crypto, leaving behind countless questions in the crypto community.

Q1 of 2022 saw the notorious Wormhole DeFi hack – a major blow to the cryptocurrency community where over $320 million (120,000 wETH) in crypto were stolen. wETH, or wrapped Ethereum was victim of a crypto exploit, demonstrating just how exposed DeFi services are. This raised many concerns and a major loss of confidence in the community. 

However, many decided to stick to crypto as Wormhole (a communication bridge gapping Solana and other DeFi networks) pledged to add Ether into the community to limit investor losses. The developers managed to bring the currency back to a 1:1 backing for the network, and that the vulnerability had been patched. This meant that the funds were safe. 

But what led to this exploit in the first place? What was the cause of the Wormhole DeFi hack? In this article, we will take a closer look at what really happened, its impact on the community, and how even after other exploits throughout 2022, Wormhole managed to hold its own. 

Understanding The Wormhole DeFi Hack

Wormhole DeFi is a decentralized finance protocol that allows users to earn interest on their cryptocurrency holdings. The protocol is designed to be simple and user-friendly, making it a great option for those looking to get started in the world of decentralized finance. 

Wormhole interest rates have always been very attractive, making Wormhole DeFi a great way to grow crypto portfolios quickly. In addition, the protocol has always been known for offering a large number of other features that make it a well-rounded option for those looking to get involved in decentralized finance. 

The platform has managed to remain friendly not just for beginners but for experts and developers alike since its inception in 2020. 

The Wormhole DeFi Hack

Though it happened before the LUNA-UST crash, the Wormhole hack was a major hit to the community – and many believe it to be the first straw that led to the “perfect storm” cryptocurrencies faced throughout Q1 and Q2 of 2022. 

The Wormhole DeFi protocol was the victim of an exploit on February 2, 2022, which resulted in the loss of over $325 million worth, i.e., 120,000 wETH. The team behind Wormhole DeFi has since taken steps to improve the security of the platform, and they are offering a bounty of up to $10 million for information leading to the arrest and conviction of those responsible for the hack. The developers also offer ethical hackers a bug bounty to help identify bugs and exploits. 

Methodology

Ethereum was one of the most used blockchain networks, but Solana became the new underdog by offering even quicker transactions and lower gas fees; a number of users were actively shifting between the two. Wormhole protocol allowed users to shift tokens, currencies, liquidity, and NFTs from Ethereum to Solana (and the other way around) easily. 

According to several vulnerability reports (such as the audit report from CertiK), the Feb 2022 attack involved the attacker bypassing the verification process that bridges the Ethereum and Solana networks. Once bypassed, the hacker was able to mint themselves 120,000 wETH.

They injected a spoofed sysvar account that then generated malicious messages as orders. The order was to mint new wETH first, and then with the “complete_wrapped” order, the hacker managed to export the ETH. 

To spoof the sysvar account, the attacker used a “verify_signatures” function through the account. 

“verify_signatures” function

Look at the #4 entry. The correct entry should have been:

#4 Account3: Sysvar: Instructions

Because of the spoofed order, the function loaded the wrong set of information (in easier terms), forcing the network to bypass the validation step. Instead, verification was done by the attacker via a “post_vaa” function, which led to the following exploit.

"post_vaa" function

The developers quickly took to preventing this issue from occurring in the future, though. 

Despite this setback, Wormhole DeFi remains a strong option for those looking to get involved in decentralized finance, and the team is committed to continuing to build a secure and robust platform.

How Much Was Lost To The Hack?

According to audit reports, the exploit involved first minting new currency and then exporting it via the verification system. As a result, the hack resulted in the loss of over $251 million worth of ETH and $47 million worth of Solana from the liquidity pool. 

Furthermore, over $4 million were stolen in the form of USDC Stablecoin from the platform. The Stablecoin was pegged on the Ethereum platform for the price of the US dollar. 

Combined, the Wormhole DeFi hack became the second-biggest theft in the world of cryptocurrencies since the Poly Network exploit in 2021. This exploit amounted to $600 million in tokens. However, this is still the largest theft affecting Solana as it starts rivaling Ethereum for DeFi and NFT space.

What Steps Have Been Taken To Improve Security?

As per several audit reports, it was recommended to the developer that a robust check and verification process be implemented with every account and function. This step was overhauled to limit external source access control with more checks, hence reducing the risks involved. 

Furthermore, the team behind Wormhole DeFi has taken a number of steps to mitigate the impact of said exploit. They introduced countless ETH into the system to bring the system back to a 1:1 ratio, as per the Wormhole Twitter account. It took several hours to bring the currency back on track, but because of investor confidence, the selling ratio did not lead to a price crash. 

According to reports, the developers introduced ~96,000 wETH into the Ethereum blockchain. However, the source of these wETH was not announced and is still unclear. 

What Does The Future Hold For Wormhole DeFi?

Despite the recent hack, Wormhole DeFi remains a strong option for those looking to get involved in decentralized finance. In addition, the protocol offers a number of features that make it a well-rounded option for those looking to get involved in decentralized finance. 

Unfortunately, this hack is not the first problem that Solana has faced, nor is it the last. It only added to the numerous problems associated with the blockchain. For example, in 2021, it faced a 17-hour downtime after being attacked by trading bots. Another recent attack on Solana managed to degrade its performance for quite a while. 

Despite lower transaction costs, confidence in the platform seems to be dwindling. Solana’s native currency has also seen a decline recently, despite high volume and trading. 

Wormhole DeFi History

Wormhole DeFi was created in 2020 by a team of experienced cryptocurrency and blockchain developers led by Curtis Hutten. 

The team’s goal was to create a decentralized finance protocol that would be simple and user-friendly yet offer features that would appeal to both beginners and experienced users alike. In order to achieve this, the team designed Wormhole DeFi to have a number of unique features that make it stand out from other protocols in the space. 

The Wormhole DeFi protocol is based on the Ethereum blockchain, making it a permissionless and quick platform. This means that anyone can use the protocol without having to go through a central authority. The protocol is also designed to be scalable, so that it can handle large amounts of traffic as more users begin to use it. 

In addition, the team behind Wormhole DeFi is committed to transparency, which is another key selling point of the protocol. This transparency was relatively clear after the hack as they managed the situation fairly well. However, there are several uncertainties still about the immediate recovery the platform managed to make, introducing over $200 million into the ETH network. 

The Ever-Increasing String of DeFi Hacks

Wormhole DeFi is hardly the first DeFi protocol to fall victim to a hack in 2022. In fact, hacks have become something of a commonplace occurrence in the world of decentralized finance, with a number of high-profile protocols being targeted in recent months. 

Some notable examples include the MakerDAO hack, which resulted in the loss of over $7 million worth of ETH, and the bZx protocol (lender) hack, which resulted in the loss of over $55 million worth of BTC. Then there is the very recent LUNA-UST crash that impacted DeFi as a whole in some ways. 

Despite the recent increase in hacks though, decentralized finance remains a promising area of the cryptocurrency space. This is because of developers’ ability to quickly make good the loss(es) that investors face and continue offering value against liquidity. 

Furthermore, the ability to trade and invest without having to rely on centralized exchanges is a game-changing development, and it’s likely that we will see more people getting involved in DeFi as time goes on. 

Wormhole DeFi remains an important player in the world of decentralized finance, and the Feb 2022 hack is a reminder of the risks associated with investing in DeFi protocols. Thanks to the team behind Wormhole DeFi, the protocol remains a strong option for those looking to get involved in decentralized finance.

Search

🟢 For owners who have made impactful changes and would like an update to their farm review:

1️⃣ Use #update at @RugDocChat with your description and proof of changes and it will be forwarded to our scanners.

2️⃣ This does not guarantee a change in your review.

3️⃣ Owners who have difficulty solving the issues can consider our Consultation Package – please contact @BaymaxCrypto on Telegram to discuss.

Our mission here at RugDoc is to screen for hard rug code that results in 100% theft of ALL underlying funds for ALL participants.

This is the ONE part of the due diligence process that most people cannot simply do on their own as it costs thousands of dollars to hire a senior solidity developer to look over a farm for safety.

A project coin with terrible code can go up in price, and a project with good code and a good team can also go down in price.

Do NOT use our ratings to refer to your likelihood in making money if you invest in the project. They are ONLY in reference to code safety.

Everything else beyond code safety is YOUR responsibility to go do research on. We just make sure the casino you’re betting in won’t rob you before you even get to place a bet.

Our reviews for projects are organized into a few colors.

🟢 Least Risk
These projects are the least likely to hard or soft rug. Usually reserved for cornerstone projects of an ecosystem where it makes no financial sense for them to rug in any manner as they make more money just being legit.

🔵 Low Risk
These projects are usually established projects in an ecosystem that have a track record of success or have KYC’d to us or other authoritative sources in the real world. As a result, it is extremely unlikely for them to soft rug or hard rug their projects. The projects can still fail and the token price can go down, but usually more as a result of natural market forces.

⚪️ Some Risk
This is the default rating for projects with unknown teams but have code that is unlikely to have hard rug risk. Since the team is unknown and doesn’t have a track record of success, it’s entirely possible that they may try to soft rug by dumping tokens, abandoning the project, etc. Even a last minute contract swap to a malicious contract is possible. The only thing that is unlikely is a complete hard rug as long as you are 100% sure you deposit into the contract we review.

🟠 Medium Risk
Similar to Some Risk, but the underlying code itself is custom enough or complex enough that it warrants an elevated risk rating that needs deeper research. Make sure you read every point presented to make sure you’re comfortable with that before entering. Still unlikely to hard rug, but more chances of custom code behaving incorrectly and causing other issues.

🔴 High Risk
Project contains code or practices that are HIGHLY LIKELY to lead to catastrophic losses as they are right now. Make sure you read the description carefully as we will always warn what these issues are. If you see the words Hard Rug anywhere in the review, STAY FAR AWAY!

⚫️ Not Eligible
We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours. Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.