10 Quick and Dirty Facts about the bZx Hacks

Quantstamp Announcements
February 27, 2020

10 Quick and Dirty Facts about the bZx Hacks


These facts are brought to you by Quantstamp, a leading DeFi security company. 

#1  The 1st hack used Tornado Cash to stay anonymous (source)

#2  The 2nd hack used ShapeShift to stay anonymous (source 1) (source 2) . 

#3  Both hacks were each carried out in a single atomic transaction (attack 1) (attack 2).

#4  5 money legos and over 25 contracts were used in the 1st hack (source).

The first hack interacted with 5 different protocols (Kyber, Uniswap, dYdx, bZx and Compound) and over 25 smart contracts; this highlights the massive composability of these money legos. This all took place in a single transaction.  

#5  Flash loans were used in both hacks, but they worked as intended. 

Flash loans were never exploited. Their purpose in the attacks were to provide the attackers with enough capital to produce massive slippage in low liquidity DEX markets.  

#6  The 1st attack was not an oracle attack. 

Uniswap was targeted in the 1st attack, but Uniswap was targeted because it was vulnerable to slippage, not because it was used as a price oracle. 

#7  The 2nd bZx attack was an oracle attack. 

bZx made the mistake of calculating the value of collateral within their system using DEX price oracles. The attacker took advantage of this by causing massive slippage in sUSD DEX markets in order to temporarily inflate the value of sUSD calculated within the bZx system. Once the attacker took out the loan, the position was instantly “underwater” because of the inflated value of the collateral. 

#8  Each hack left an underwater position open in bZx. 

A loan is underwater when the value of the collateral is not enough to cover the outstanding debt of the loan. The 1st bZx hack instantly left a position underwater by approximately 640,000 USD worth of cryptocurrency. The 2nd bZx hack instantly created a position that was underwater by approximately  800,000 USD. 

#9  bZx’s flash loan was used in the 2nd hack  

In the second attack, the attacker used bZx’s flash loan feature. The first attack used dYdX’s flash loan feature.

#10  These hacks may have been conducted by two different people. 

There is no evidence that these attacks were conducted by the same person. 

--

For more Quantstamp news or anything QSP crypto or QSP coin related, check out Quantstamp Reddit and QSP Twitter.



Quantstamp Announcements
February 27, 2020

10 Quick and Dirty Facts about the bZx Hacks


These facts are brought to you by Quantstamp, a leading DeFi security company. 

#1  The 1st hack used Tornado Cash to stay anonymous (source)

#2  The 2nd hack used ShapeShift to stay anonymous (source 1) (source 2) . 

#3  Both hacks were each carried out in a single atomic transaction (attack 1) (attack 2).

#4  5 money legos and over 25 contracts were used in the 1st hack (source).

The first hack interacted with 5 different protocols (Kyber, Uniswap, dYdx, bZx and Compound) and over 25 smart contracts; this highlights the massive composability of these money legos. This all took place in a single transaction.  

#5  Flash loans were used in both hacks, but they worked as intended. 

Flash loans were never exploited. Their purpose in the attacks were to provide the attackers with enough capital to produce massive slippage in low liquidity DEX markets.  

#6  The 1st attack was not an oracle attack. 

Uniswap was targeted in the 1st attack, but Uniswap was targeted because it was vulnerable to slippage, not because it was used as a price oracle. 

#7  The 2nd bZx attack was an oracle attack. 

bZx made the mistake of calculating the value of collateral within their system using DEX price oracles. The attacker took advantage of this by causing massive slippage in sUSD DEX markets in order to temporarily inflate the value of sUSD calculated within the bZx system. Once the attacker took out the loan, the position was instantly “underwater” because of the inflated value of the collateral. 

#8  Each hack left an underwater position open in bZx. 

A loan is underwater when the value of the collateral is not enough to cover the outstanding debt of the loan. The 1st bZx hack instantly left a position underwater by approximately 640,000 USD worth of cryptocurrency. The 2nd bZx hack instantly created a position that was underwater by approximately  800,000 USD. 

#9  bZx’s flash loan was used in the 2nd hack  

In the second attack, the attacker used bZx’s flash loan feature. The first attack used dYdX’s flash loan feature.

#10  These hacks may have been conducted by two different people. 

There is no evidence that these attacks were conducted by the same person. 

--

For more Quantstamp news or anything QSP crypto or QSP coin related, check out Quantstamp Reddit and QSP Twitter.



Get your DeFi app secured by Quantstamp
Secure Now!
November 11, 2020

Quantstamp Community Update - October 2020

‍Audit of Ethereum 2.0 client Teku, blockchain insurance, Open DeFi, virtual events, and more media coverage... here’s what happened at Quantstamp in October.‍

November 5, 2020

Why Bitcoin is Capturing Enterprise Attention

MicroStrategy made headlines this summer as the first publicly-traded company to buy Bitcoin as part of its capital allocation strategy. Since then, other companies have followed suit. Learn how current economic conditions and the unique properties of Bitcoin have driven these decisions.

October 28, 2020

Formally Verifying Hedera Hashgraph's Stablecoin Framework

Quantstamp created and formally verified a specification for Hedera Hashgraph stablecoins. This simplifies the process of creating safe stablecoins and also makes easier for partners to safely integrate them.

October 27, 2020

Quantstamp Completes Audit of 2nd ETH 2.0 Implementation

Quantstamp has now completed its audit of Teku, the Ethereum 2.0 client developed by ConsenSys. Quantstamp also audited Prysm by Prysmatic Labs.