Wormhole hack illustrates danger of DeFi cross-chain bridges

Solana has change into one of many fastest-growing sensible contract blockchain networks because it was first formally launched in March 2020. 

The entire worth locked (TVL) on decentralized finance (DeFi) protocols on the community grew from almost $152 million in March 2021 to $8.08 billion on the time of writing, as per information from DefiLlama.

Concurrently, the community has additionally been topic to a number of community points and outages. Most just lately, the Wormhole token bridge was hit by a security exploit on Feb. 3 that culminated within the lack of 120,000 wrapped Ether (wETH) tokens, price over $375 million on the present worth of Ether (ETH). 

This exploit was the largest to this point in 2022 and the second largest DeFi hack ever, following the Poly Community hack the place over $600 million was stolen from three totally different blockchain networks when an Ethereum bridge was compromised.

Wormhole is a token bridge protocol that connects a number of blockchain networks like Ethereum, Solana, Terra, BNB Good Chain, Polygon, Avalanche and Oasis. It allows customers to ship and obtain tokens between these networks with out the necessity for a centralized trade or tedious conversion processes. Whereas wrapped Ether was the one asset impacted by this exploit, Certik, a wise contract auditing agency, talked about that Wormhole’s bridge to the Terra blockchain community may very well be impacted by the same vulnerability because the Solana bridge. 

The token bridging protocol has launched an in depth incident report that tracks the chronology of the hack and all of the related points of it together with safety audits, bug bounties and the safety roadmap. Cointelegraph mentioned this hack with Max Galka, the CEO of blockchain information analytics agency Elementus. He stated:

“About three hours earlier than the Ether was taken from Wormhole, the pockets that’s at the moment holding the stolen funds had a smaller transaction deposited from Twister Money — a mixer that anonymizes transactions. There was a switch from a mixer on Ethereum to this pockets now holding the stolen funds.”

Galka additional talked about that whereas it’s evident as to why the hacker would have experimented with Twister Money within the first place, it’s much less clear as to why they might use the mixer to deposit funds precisely into the identical pockets earlier than executing a serious exploit.

Quickly after, Wormhole launched a bug bounty program with Immunefi on Feb.12 with a $10 million reward that covers sensible contracts, internet consumer interface (UI), guardian nodes and Wormhole integrations. This makes it the most important bug bounty program within the cryptoverse, on par with Maker DAO’s bug bounty program.  

Bounce Crypto, the crypto funding arm of buying and selling agency Bounce Buying and selling and one of many lead traders backing Wormhole, has stepped in to “make the group members entire.” The enterprise capital agency has replaced the 120,000 ETH and said by way of a Twitter submit on the identical day of the hack that the agency believes in a multichain future and that Wormhole is crucial infrastructure for this future.

Safety issues with cross-chain exercise

Vitalik Buterin, a co-founder of Ethereum, wrote on a Reddit AMA session together with the Ethereum Basis’s Analysis Staff the place he stated that the way forward for blockchain expertise is multichain and never cross-chain. Buterin has reasoned this with safety issues of bridges and non-native token belongings with a concentrate on the likelihood of 51% assaults. He stated, “It’s all the time safer to carry Ethereum-native belongings on Ethereum or Solana-native belongings on Solana than it’s to carry Ethereum-native belongings on Solana or Solana-native belongings on Ethereum.”

My argument for why the longer term might be *multi-chain*, however it won’t be *cross-chain*: there are elementary limits to the safety of bridges that hop throughout a number of “zones of sovereignty”. From https://t.co/3g1GUvuA3A: pic.twitter.com/tEYz8vb59b

— vitalik.eth (@VitalikButerin) January 7, 2022

Jagdeep Sidhu, the chief expertise officer of Syscoin, a proof-of-work (PoW) blockchain community that’s “merged-mined” with Bitcoin, spoke to Cointelegraph additional on this narrative. He stated, “He merely implies that the place there’s a blockchain, there’s a zone-of-sovereignty inside that chain which has free will on the safety of that blockchain. Any time blocks roll again, for instance, all programs relying on the safety of that chain additionally roll again. Due to this, when creating cross-chain bridges, it’s a must to both assume a brand new consensus system that may watch and act on rollbacks or cautiously wait across the prospects of a rollback, relying on the worth of the transaction.”

Sidhu additional stated that the Wormhole hack revealed the complexities of making cross-chain exchanging and bridging, because the assault was solely enabled as a result of an externality by the Solana crew which rendered a sure operation within the consensus code legacy. This operation opened a loophole within the logic of Wormhole that was taken benefit of by the hacker.

Regardless that this explicit hack impacted a cross-chain bridge, it’s noteworthy that, technically, this was a wise contract exploit, which has been round so long as the idea of sensible contracts has existed. Galka said:

“The historical past of sensible contracts has concerned a fairly constant stream of vulnerabilities and hacks courting again to the very early days of Ethereum when The DAO was attacked in 2016. Typically, cross-chain bridge contracts have giant balances making them prime targets. Traditionally, there have all the time been hacks on sensible contracts. I’d anticipate that to proceed.”

Cointelegraph additionally mentioned this facet of the hack with Anton Bukov, co-founder of the 1inch Community, a DEX aggregator, who talked about that the trigger that led to this hack was a low-level sensible contract bug. It was associated to the mechanism that Solana used for precompiled sensible contract calls. He famous that the bug repair was publicly available on the interoperability protocol’s GitHub repository for greater than two weeks earlier than the hack. 

The repair being publicly obtainable might’ve been the cue for the exploiter to establish the hack. Bukov additionally agreed with Buterin’s issues with cross-chain operations and said that “Cross-chain operations are rather more harmful and weak than every other blockchain operations.”

Not less than 5 bridges had been hacked since mid-2021, attackers had been capable of steal greater than $1B. By no means underestimate safety audits significance. Three hacks in the past @VitalikButerin warned us about cross-chain risks: https://t.co/jvmLOIEQlE pic.twitter.com/bQoht0FNve

— Anton Bukov ⚖️ (@k06a) February 3, 2022

Zero-knowledge rollups 

Regardless of Solana’s fast progress within the quick time since its launch, the community has change into more and more prone to points as extra customers start to come back onboard. The community had a foul begin to the 12 months when it faced six community outages in January that brought on a variety of frustration to its group.

Associated: Scalability or stability? Solana network outages show work still needed

Sidhu identified that Solana, like all different different sensible contract networks, makes use of a monolithic structure that doesn’t present for economies of scale. Resulting from this, as extra customers come onto the community, the charges and the sources to maintain the community secure, safe and decentralized will enhance. 

Suggesting an alternative choice to this incoming situation, he stated, “One of the best ways we all know to scale is thru a modular structure. That is what Ethereum and another blockchains akin to Syscoin are transitioning towards as a result of creation of nice scaling options akin to optimistic and zero-knowledge proof based mostly rollups.”

Proving an in depth answer for this situation, Sidhu talked about that the most effective answer for cross-chaining belongings is to make use of zero-knowledge (ZK) proofs as a greater different to having the pool of cash sitting on an exterior consensus akin to a multi-party protocol which requires an sincere majority assumption of exterior validators. This use of ZK-proofs would change the exterior consensus with mathematical validity proofs. 

Nonetheless, he additionally added that not one of the options are as safe as utilizing a dependable layer 1. He added, “A ZK bridge is a promising enchancment to cross-chain bridging, however I don’t suppose it ought to be used as a generic cross-chain DeFi ecosystem, as, by definition, it can not present as a lot safety as merely utilizing a safe layer 1.”

Bukov famous the probabilities of this hack being replicated with bridges on different blockchain networks as effectively:

“Traditionally talking, there have been instances of 1 occasion exploiting code after which copycats seizing on this preliminary exploit. In 2017, a sequence of multisignature Ethereum wallets had their underlying code hacked. On this occasion, a number of follow-up hacks occurred by different actors seizing on the identical vulnerability.”

This hack may very well be an indication for core builders of interoperable bridging protocols and different sensible contract blockchain networks to proceed with warning for cross-chain sensible contracts and belongings and work on common updates, audits, bug bounties, and many others., to plug expensive loopholes like these of their operations.