PEP-07 - Grant Request From the ParaSwap Foundation Regarding March 20th Vulnerability

Governance Proposals
,
1

Abstract

On March 20, 2024, a vulnerability was discovered on the Augustus V6 contract. Immediate action was taken, which included pausing the API and reverting to V5. After these actions, white hat operations were conducted, securing over $3.4 million in assets, followed by a return process of these secured funds for users who had revoked their V6 contract permissions.

Certain users remained vulnerable until they revoked their V6 contract permissions, and some added funds before revoking. Some of their wallets were then drained by hackers, unfortunately.

The hackers have been contacted and some agreed to a partial return after negotiations. However, we have to date not been able to recover all funds taken from the V6 contract. The Foundation has considered it important to provide full refunds to affected users with a view to the long-term sustainability of this project. This proposal outlines a mechanism for those affected by the vulnerability but not covered by the white hat hack and requests a grant from the DAO to help refund users.

Goals and Review

On March 20, a security vulnerability was discovered on the Augustus V6 contract. This vulnerability was considered a critical priority, as anyone who had given permissions to the V6 contract could be affected by it. We have made every effort to communicate at various social media channels to brief users on the need to revoke all their V6 contract permissions immediately.

After the vulnerability was found, developers took immediate action to address the vulnerability, including the pausing of the API and removal of all V6 contracts from the UI. Additionally, Augustus V6 has been self-destructed on all chains where it was possible (Polygon, BSC and Avalanche). Furthermore, core developers and white hat hackers executed a series of follow-up recovery operations, including 0xc0ffeebabe.eth, who recovered approximately $700,000.

In total, the white hat recoveries managed to secure a total of $3.4 million plus reduce any future ParaSwap user from being affected, as the contracts were stopped less than 48 hours after their public release.

Despite these recovery measures, two categories of users were still affected by the vulnerability:

  1. Pre-white hat victims: These users were exploited before the white hack operation. In total, $24,000 of assets were lost.
  2. Post-white hat asset deposit with compromised V6 contract permissions: These instances occurred when a user deposited funds on a still compromised address, resulting in an exploit. In total, ~$840,000 is still outstanding.

UPDATE: Following new developments, the outstanding amount has been reduced to ~$340k

The list of all affected user addresses can be found here: ParaSwap March 20th Vulnerability Affected Users - Pastebin.com.

In the view of the Foundation, to support the community and promote the ongoing vitality of the protocol, it is essential to offer compensation to pre-white hat and post-white hat victims as described in the two categories outlined above, up to the point of this proposal. Accordingly, the proposal sets the following goals:

  1. Earmark funds from the treasury to compensate users whose funds were not returned by the white hat operation and have heeded our instructions to revoke V6 contract permissions at the time of this proposal.
  2. Design and execute a process for compensation using the earmarked funds.

While we do not believe that there is a legal obligation on any party other than the exploiting parties to compensate users whose funds have not been recovered following the V6 contract exploit, we believe in the circumstances, it is right and appropriate and in the best long-term interest of the protocol that the DAO considers the compensation proposal as soon as possible. As such, the voting window will be 48 hours.

An appropriate post-mortem will be carried out following this proposal. The situation is still ongoing and is being carefully addressed and analyzed.

Means

The ParaSwap Foundation has already been taking an active role in mitigating the consequences of this vulnerability. This proposal aims to request the following assets currently not used by the DAO for complete user compensation:

  • The unused wETH/ETH accumulated by the DAO until epoch 15, totaling ~150 wETH.
  • The accumulated FTM from Fantom’s Gas Program, totaling to 27,207.53 FTM.

The amount of the assets can be estimated from this bundle.

The requested funds will be allocated towards user compensation and addressing additional expenses from the exploit. The Foundation will cover the remaining costs linked to the vulnerability, including the refunds, the engagement of security analysts, conducting thorough contract re-audits, communication with authorities, and the formulation and execution of the refund process.

Implementation Overview:

  1. Transfer of requested funds to the ParaSwap Foundation.
  2. Creation of a claims process by the ParaSwap Foundation.
  3. Return of funds by affected parties for all who complete the claims process.

While these steps are happening, the team will be dedicated to providing updates and serving the community to rectify the situation.

UPDATE: Following new developments, the outstanding amount has been reduced to 103 ETH

12 Likes
2

EDIT:

Following this security flaw in V6, it is important to preserve as much as possible a positive image of Paraswap and to maintain the trust of users and partners.

I think we must do this even though it impacts “a part but not all” DAO cash flow…

I am therefore in favor with adjusted parameters cited below that they make sense regarding responsibilities:

6 Likes
3

Thank you for this proposal.

I’d like to come back to some points that bother me. You have rightly, for some, and abusively for others, undertaken the granting of a large part of the DAO’s cash for the development of Paraswap.

It now transpires that this development was a failure and needs to be repaid. A repayment that the DAO should therefore bear.

To begin with, I’d like to understand how this failure came about.
You teased V6, you’ve had 1 year to write it and then you get hacked on day 1 and ridiculed on the networks for “apparently” making an aberrant code error.
Who audited this contract? Did you have it audited? What is the process between the idea of an intelligent contract and its public release?

Furthermore, I note that $24k was stolen before the white hat intervention and $840k afterwards. The problem is that the contract is still online on certain channels and that the exploit will remain until the addresses are revoked.
This means that, as you say, the reimbursements will have to continue, albeit at the foundation’s expense, which is unthinkable.
Everyone is responsible for their signatures and, above all, everyone should be vigilant in the cryptographic world.

Paraswap quickly warned that an exploit was active, the Paraswap site issued a warning, revoke issued tweets etc.
Vigilance is necessary.

I’m in favour of reimbursing wallets that have revoked the contract less than 24 hours after the first tweet about the hack. The others should not.

In addition, I think the DAO has always been happy to contribute to the development of Paraswap. Whether it’s in human or financial terms, but it works when there are results.

The DAO’s financial contribution to the implementation of V6 is a failure, a failure that is the responsibility of the core team.
Where does the DAO’s responsibility lie in this equation?

Let me remind you that the DAO paid $300k arb to make up for an error by a multi-sig signatory during one of the first epochs of psp 2.0.

However, hat the DAO was kind enough to give all the non $eth cash to the core team. In short, the money that the DAO has paid out to date at the Foundation’s request has unfortunately been wasted.

I don’t doubt the effectiveness of v5, which works perfectly well. But this v6 is going to be a blow to the protocol.

I hope you’re not thinking of re-launching it without renaming it.

3 Likes
4

In light of the security vulnerability discovered in V6, it’s crucial to uphold Paraswap’s positive reputation and retain the trust of both users and partners. Despite the potential impact on the entire DAO’s cash flow, I believe it’s necessary to prioritize these measures. Therefore, I am in support of this approach.

5 Likes
5

photo_2024-04-02_22-00-42
photo_2024-04-02_22-00-42500Ă—751 59.4 KB

A picture is worth a thousand words.

It is impossible to refund the adresses that did not revoke.

3 Likes
6

I appreciate the efforts that the foundation is going through to save face and remain the leading aggregator. I do have the following questions:

Will the reimbursements cover the price action of the stolen funds or will it just take in consideration the price at the time of the exploit?

Some tokens increased / decreased in price but there was no way to manage the funds while waiting for a refund. Is the opportunity cost taken into account?

A previous exploit that has been very well managed and appreciated by the crypto community was the Unibot router hack. Maybe this can be used as inspiration if needed.

7

I agree with bloute19, we need more info before making a decision.

I think we all would like to know who audited the contract because they should have their part of responsability, they failed at their work, and should be at least be accountable for a part of the reimbursement.

Agree also on the fact that we should not reimburse people who didn’t revoke contract after a certain amount of time after the first announcement of the hack. But on this I would like to know how much money was stolen during the first 24h, and the next 24h and so on to see how much it represent and if limiting the amount of time is worth or not in terms of money/public image risk ratio. The point is though that we shouldn’t be responsible for people allowing unlimited amount on their token and not following info or news, it’s a risk they take.

Anyway it’s the second error that drain the DAO treasury, at this rate it will coming difficult to use DAO fund for marketing that we’ll absolutely need to do at one point if we want the project to succeed. I don’t want to FUD at all because this project as like a ton of potential and I’m personally here for the long run but please, be more carefull in the future about all your process, even if it’s take longer time to deploy things. Better be safe than sorry.

6 Likes
8

Following the procedure of PIP41, the Governance Committee has voted this proposal qualifies for Tier 1 Express PEP

3 Likes
9

Glad to see some animation on the DAO, too bad it’s for a hack…

I agree with Aypierre
I don’t understand the rush to pass this proposal as a matter of urgency.
We need figures and an understanding of the responsibilities of each entity that made this hack possible.
Reimbursing the earliest users seems to me to be a good way forward. We’ll have to see what the figures show.

We need to step back, take our time and discuss things calmly now that the storm has passed.
The DAO is not the Foundation’s airbag but an entity that works with it.

I remain firmly convinced that Paraswap will have its hour of glory, but this hack will clearly delay adoption. Revenues are still good on V5, so well done for managing it so well.

In closing, I’d like to suggest that this discussion should be treated as a normal, non-urgent proposal. The important thing remains to protect Paraswap from FUD and deserving users by reimbursing them intelligently.

10

Same，Effective and quick measures can better solve the problem

3 Likes
11

Firstly, I support this proposal. Here are my views and questions:

  1. Timely and effective handling of issues will help enhance Paraswap’s good reputation and future development.
  2. I agree to compensate the victims who revoked contract authorization before this proposal was made. Time-wise, it’s already at the maximum limit.
  3. Responsibility is the most important quality for a team, and we are pleased to see this.
  4. I am very puzzled as to why such a serious vulnerability occurred. Was there a security audit conducted before the release?
  5. The team has spent a long time developing v6, and we acknowledge the team’s hard work. However, please refrain from rushing to launch new versions again. It is crucial to undergo sufficient testing and thorough security audits to prevent such incidents from happening again.

In conclusion, since the incident has already occurred, please efficiently and promptly resolve the current issues to avoid delaying subsequent work.

5 Likes
12

This is a chance for us to change the image that the market has of Paraswap since the unfortunate airdrop. Let’s stay united. Let’s be responsible and keep a long-term vision.
We should accept this Proposal.

3 Likes
13

I think Paraswap should maintain this trust, as PSP still has a long way to go in the future. Moreover, users are innocent and not intentional. Everyone should return to the most fundamental starting point. Is it wrong for users to use Paraswap? Of course not

2 Likes
14

You’re not right. I think the team’s proposal is long-term, has a sense of justice, and is also very visionary, because the development prospects of PSP are unpredictable, so maintaining trust is the foundation!

2 Likes
15

I think what you said is very correct. Your proposal is beneficial for future development!

1 Like
16

I have noted the following situations:

  1. 99% of assets were stolen within 2 hours after the announcement，This is not because assets were lost due to failure to revoke authorization within 24 hours.
  2. Information dissemination has a lag, and not all victims were able to timely and effectively see the information and respond.
  3. Some victims quickly revoked authorization after losing funds, but it is evident that they revoked the wrong contracts such as v5. It took them some time (1-2 days) to revoke the correct contract authorization.

Given the above reasons, I strongly support compensating the victims who revoked contract authorization before this proposal was made. This is the most sincere and responsible solution.

17

Are there any documents on the chain to prove this?
I’m not prepared to believe anything anyone says any more.

Still no answer here?

I’m still of the opinion that there’s no hurry and that we should take the time to respond to everyone before launching a vote.

There is no fud that justifies a rush. We’re talking about emptying the DAO’s coffers! It’s unthinkable to do it in a hurry

I’d appreciate it if the members of the core team could give us the information we’re looking for.
@Lup

Thank you in advance

18

Since the initial proposal, part of the funds have been returned – which would belong to Category 2 – from the hacker who had misappropriated the most funds. The total amount recovered from that hacker is approximately $500k worth of assets, which comprises ~63% of the outstanding amount previously conveyed. Given this partial recovery, the proposal is being amended to reduce the size of the grant to cover the new outstanding value of $340k, which equates to approximately 103 ETH.

We have also considered community feedback on the proposed 24- to 48-hour window. While shortening the time frame could prove beneficial, considering that the majority of users were impacted within this window, a stricter deadline may also disappoint others

As with every previous contract that has been released, this contract was audited as well. We will communicate on new audits and security measures that will be taken in the near future.

Here are the audits that were conducted for V6: Hacken, Astrasec. A detailed post-mortem will be shared following this proposal.

As this is a time-sensitive matter, and many affected users are waiting for further developments, we are aiming to release the proposal for a vote later today.

5 Likes
19

What is the amount hacked related to wallets that have revoked the contract at time T?

I may be wrong but wallets that still haven’t revoked can’t be refund, no?

20

Good to hear this. Hope refund happen soon cause that’s 70% of my funds in trading.