Bonq Euro

Bonq DAO protocol on Polygon, similar to MakerDAO&#39;s lending service, <a href="https://www.theblock.co/post/207799/bonqdao-exploited-for-88-million-allianceblock-tokens-stolen-during-the-exploit" rel="noopener noreferrer nofollow">got rekt</a> yesterday. About $1.2 million worth of stolen assets have been converted. Once again, the protocol’s oracle became the vulnerability.Tellor, the oracle that this lending protocol relies on, had a security vulnerability in updating the price of WALBT, allowing the attacker to submit a fabricated price by staking just 10 TRB. The new quote somehow passed the checks of the contract TellorFlex.sol, allowing the attacker to borrow 100,000,000 BEUR in <a href="https://eigenphi.io/mev/eigentx/0x31957ecc43774d19f54d9968e95c69c882468b46860f921668f2c55fadd51b19?allow-different&#61;0&amp;disable-reverse-debt&#61;0&amp;hide-inter&#61;0&amp;rankdir&#61;LR&amp;show-net-asset-flow&#61;0" rel="noopener noreferrer nofollow">this transaction</a> with a tiny amount of WALBT pledged to BonqDAO.<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/96ce3d3ac67f4760999a73461ebfd483.png" />Here are the proofs of our analysis.The detailed call trace from <a href="https://phalcon.blocksec.com/tx/polygon/0x31957ecc43774d19f54d9968e95c69c882468b46860f921668f2c55fadd51b19" rel="noopener noreferrer nofollow">Blocksec</a>:<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/dedc04de1e4b4541a38e1f6b0932b2a3.png" />And the code causing the problem:<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/6065a591b8754482a46e3f6e5c6598c4.png" />You can read the more detailed report from our partner <a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">SlowMist</a>.EigenPhi has systematically studied several DeFi risk events, including the <a href="https://eigenphi.substack.com/p/the-arbitrageur-who-beats-everyone" rel="noopener noreferrer nofollow">Ankr attack</a> and Lodestar Finance attack that occurred in Q4 last year, and proposed <a href="https://eigenphi.substack.com/p/tokenomic-trilemma" rel="noopener noreferrer nofollow">The Tokenomic Trilemma framework</a> to explain the root cause of these attacks.The Tokenomic Trilemma puts forward the thesis that a token is difficult to simultaneously achieve three conditions: free tradability, anchored price, and independent issuance. Unlike the Ankr and Loestar incidents, where The Tokenomic Trilemma shows the exploitation of the protocol&#39;s design flaws was the cause, the framework does not cover BongDAO&#39;s exploitation, and we classify the cause as a technical flaw.We can use The Tokenomic Trilemma to organize all the DeFi risk events into 5 categories:<ol><li>Attacking the token&#39;s issuance mechanism. I.E., Ankr Attack, and Lodestar Finance attack. </li><li>Manipulating the underlying token&#39;s market liquidity. I.E., Mango Squeeze, and CRV Short-squeeze. </li><li>Algorithmic stablecoin. I.E., UST-Luna Saga. </li><li>&amp; 5. Technical flaws.</li></ol>To mitigate these risks, the industry needs to focus more on liquidity data. We propose that a feedback system based on real-time liquidity sensors is indeed helpful in achieving proactive risk management.Please feel free to leave your comments on <a href="https://eigenphi.substack.com/p/tokenomic-trilemma" rel="noopener noreferrer nofollow">The Tokenomic Trilemma framework and other risk events analysis</a>.See more <a href="https://eigenphi.io/" rel="noopener noreferrer nofollow">EigenPhi</a> Research reports <a href="https://eigenphi.io/mev/research" rel="noopener noreferrer nofollow">here</a>.Follow us via these to dig more hidden wisdom of DeFi:<ul><li><a href="https://www.youtube.com/channel/UCQa9hWUD2vIYZrI3KsqgBWQ" rel="noopener noreferrer nofollow">Youtube</a></li><li><a href="https://twitter.com/eigenphi" rel="noopener noreferrer nofollow">EigenPhi’s Twitter</a></li><li><a href="https://twitter.com/eigenphi_alert" rel="noopener noreferrer nofollow">EigenPhi’s Twitter for MEV alert</a></li><li><a href="https://eigenphi.substack.com/" rel="noopener noreferrer nofollow">Substack</a></li><li><a href="https://medium.com/&#64;eigenphi" rel="noopener noreferrer nofollow">Medium</a></li><li><a href="https://mirror.xyz/0xc19565163aFdEe3783FC970E4Bd0275B11848d34" rel="noopener noreferrer nofollow">Mirror.xyz</a></li><li><a href="https://t.me/WisdomOfDeFi" rel="noopener noreferrer nofollow">Telegram</a></li><li><a href="https://discord.com/invite/JXD8cyzR2a" rel="noopener noreferrer nofollow">Discord</a></li></ul>

BonqDAO's Rekt, An Oracle Attack, Again.

EigenPhi

Other articles published on Feb 3, 2023

A Quick Review of the 2023 CoinMarketCap Crypto Playbook

Shido MasterCard Limited Edition!

When and Where to Buy NFTs

LABEL Foundation’s Major Roadmap for 2023 📌

Cryptocurrency Security Guide

North Korean Defectors, Libyans Indicted for ‘Kimchi Premium’ Crypto Trading

Join our free newsletter for daily crypto updates!