A report from the web3 security company, CertiK, it was revealed that the Arbitrum-based DeFi (decentralized finance) project for stablecoins, Hope Finance, lost $2 million to scammers. Further, the report revealed that the perpetrators secretly removed the amount from the funds of the users of the project.
May the Treasury be Robbed of $2 Million
A report from security firm web3 came after announcement from Hope Finance. At announcement aimed at notifying users of new fraud cases in the community. However, there are not many details about the theft case. In particular, the community Twitter account is still new since it was created in January 2023.
According to Hope Finance, the culprit was a Nigerian who transferred more than $1.86 million to a decentralized non-custodial privacy solution, Tornado Cash. This move happened after the community came to life on February 20.
The tweet came almost immediately after the theft. The information states that the user must withdraw staked liquidity from the platform’s protocol. But in order for this action to be successful, the developer created an emergency function to back off.
Vulnerabilities In Smart Contracts
According to CertiK members, the culprits changed the details of the smart contract to transfer funds from the platform’s genesis protocol quickly. On February 13, an audit by Cognitos officials have noted the vulnerability of two Hope Finance central contracts. This observation emerged after the audit review.
Two areas that show vulnerability are possible reentrancy attacks and incorrect modifiers. But the vulnerability did not affect the success of the audit, as Cognitos found the smart contract code flawless.
This incident and several others suggest additional security in the crypto ecosystem. According to a reportthe decentralized financial sector witnessed about 155 incidents of theft and the loss of more than $3.1 billion in 2022. This figure represents a 56.2% increase in fraud cases compared to the loss of $2,036,015,896 in 2021.
As for the five biggest theft cases in 2022, the total loss is more than $2.3 billion, accounting for about 59.8%. An important example to remember is the FTX crash in November 2022, which cost around $650 million.
A Brief On Hope Finance
Financial Expectations particularly committed to helping charities and foundations manage how funds flow into the system while maintaining regulations and audits. The project achieves this goal by providing foundation workflow tools, supporting budgeting, program areas, projects, IFRS accounting, grants, and more. The service is available to individuals and corporate bodies.
The platform uses the Ethereum 2 layer roll-up network known as Arbitrum. This network usually facilitates the exponential scaling of smart contracts and overcomes challenges by increasing transactions in the network, thus ensuring optimism. However, these features are not enough to prevent new exploits on the platform.
The platform’s plan to release its original algorithmic stablecoin, the Hope token (HOPE), was already in the pipeline before the attack. The community aims to adjust the supply of coins to match the price of Ether. But for now, the plan can only fly if the platform survives the attack.
Option image from Marca, Chart from TradingView.com