Callisto Network

<h2 id="header-0">An Expert’s Take on The Curve Finance Hack</h2>A Couple Of Words About Dexaran<a href="https://cointelegraph.com/press-releases/dexaran-the-lord-of-ethereum-classic-callisto-network" rel="noopener noreferrer nofollow">Dexaran</a> is the founder of the <a href="https://github.com/EthereumCommonwealth" rel="noopener noreferrer nofollow">EthereumCommonwealth</a> team, security auditor, and hacker (he has<a href="https://www.eosgo.io/blog/Eos-network-congestion-by-ddos-analysis/" rel="noopener noreferrer nofollow"> DDOSed EOS mainnet in 2019</a> and froze its DAPPs for half a year, and drained the Chintai exchange).Founder of<a href="https://audits.callisto.network/" rel="noopener noreferrer nofollow"> Callisto Network Security Auditing</a> organization that has audited more than 300 smart contracts, and not even a single one that we reviewed was ever hacked.EthereumCommonwealth built the first online version of the Vyper compiler on 11 August 2017. Here is the<a href="https://dexaran820.medium.com/ethereum-commonwealth-development-update-a6606392fd41" rel="noopener noreferrer nofollow"> report</a>. Here is <a href="https://codepen.io/yograterol/full/aypYjP/" rel="noopener noreferrer nofollow">this online Vyper compiler prototype</a>.Dexaran has<a href="https://github.com/vyperlang/vyper/issues/330" rel="noopener noreferrer nofollow"> participated in the development</a> of the Vyper programming language.In 2020 he wrote an <a href="https://www.eosgo.io/blog/development-of-new-programming-language-for-smart-contract/" rel="noopener noreferrer nofollow">article</a> that highlighted the problems of new programming language development and described what happened to Curve Finance 3 years before it actually happened.Vyper was abandoned because:<ol><li>It solves no real problems.</li><li>Developing a new programming language and/or compiler requires high expertise in compiler development — the Ethereum team doesn’t have any compiler developers who participated in the real compiler development (GCC or LLVM).</li><li>From a security point of view, it is much better to rely on existing solutions if they don’t have any critical problems that need to be addressed.</li></ol><h3 id="strong-in-short-strong">In Short</h3>One guy decided to create a new programming language (which was utterly unnecessary, to begin with), even though he had no experience developing programming languages. After that, some other guy created a compiler for it, even though he wasn’t a professional compiler developer. Then some third guy built a system that managed a massive amount of his users’ funds using all that stuff, and it all broke.<img src="https://academy-public.coinmarketcap.com/optimized-uploads/acf8af4c7362430dad543d0d89fc6573.jpeg" />Finally, they stated, “No need to point fingers at each other,” but from a security perspective, it’s the complete responsibility of the guy who decided to pick exactly THAT insecure toolchain to build critically important software with it.<h3 id="strong-what-happened-strong">What Happened?</h3>A vulnerability was discovered in a Vyper compiler, which allowed hackers to <a href="https://techcrunch.com/2023/08/01/curve-finances-62m-exploit-exposes-larger-issues-for-defi-ecosystem/" rel="noopener noreferrer nofollow">drain $62M worth of funds</a>.<h3 id="strong-the-development-of-a-new-programming-language-is-a-big-mistake-a-security-threat-strong">The Development Of A New Programming Language Is A Big Mistake &amp; A Security Threat</h3><img src="https://academy-public.coinmarketcap.com/optimized-uploads/27b706ca744245f698f540cd4f11ded4.jpeg" />Dexaran wrote the article<a href="https://www.eosgo.io/blog/development-of-new-programming-language-for-smart-contract/" rel="noopener noreferrer nofollow"> “Development of a new programming language for smart contracts is a big mistake”</a> in 2020, and the Callisto Security Department strongly recommends all blockchain developers review it before delving into any code.With the hack of Curve Finance, it became evident why this practice is a mistake.Below is the most important idea from the article:<blockquote>Developing a new compiler is extremely specific task that requires highly qualified team experienced in exact this area. All the custom compilers are orders of magnitude worse compared to the existing ones such are <a href="https://en.wikipedia.org/wiki/GNU_Compiler_Collection" rel="noopener noreferrer nofollow">GCC</a> or <a href="https://en.wikipedia.org/wiki/LLVM" rel="noopener noreferrer nofollow">LLVM</a>. This should be noted that GCC is in development for 32 years already while LLVM is 17 years in development. If someone decides to use a custom programming language for smart contracts and developed a new compiler for it then it is reasonable to expect that it will take about 15 years to bring this tools to the level of performance and security of nowadays LLVM assuming that a team of highly specialized experts is dedicated for this task.Were Vyper compilers developers going to outperform LLVM which was in development for 17 years and had a dedicated expert working on it? Were they going to outperform it in 4 years without any expertise in the area? This overlooks crucial security rules in development.</blockquote><h3 id="strong-what-has-gone-wrong-strong">What Has Gone Wrong?</h3>Everything…<ol><li>Vyper programming language – there was totally no point in creating it in the first place. What is more important, however, is that this programming language was created without involving any security experts/experts in programming language &amp; compiler development.</li><li>Vyper compiler development –  This is a very specific, cumbersome, and risk-involving task. Also done without any expertise in the area.</li><li>Utilizing this immature toolchain to build critically important parts of the financial application. Whose genius idea was to take an untested toolchain and throw users’ funds into it?</li></ol><h2 id="header-1">Security Recommendations</h2><ol><li>Read <a href="https://www.eosgo.io/blog/development-of-new-programming-language-for-smart-contract/" rel="noopener noreferrer nofollow">this article</a>. Thoughtfully, it explains everything that happened three years before it happened.</li><li>Stop the development for the sake of development. Do not implement something unnecessary. Do not put it on the table. Every line of new code has a chance to have a vulnerability or bug.</li><li>Do not use potentially insecure software. Stick to the tested options if it is not known to have serious problems.</li><li>Do not use software having security problems just because everyone uses it.</li><li>If you don’t have expertise in some area — do not think you will outperform experts. Instead, hire experts or consult with them at least.</li><li>Treat security seriously. VERY SERIOUSLY. You are dealing with your users’ funds. Think of it as you are dealing with people’s lives.</li><li>Choose your auditors wisely. Your security auditor must be (1) transparent and (2) competent. There are a lot of “marketing auditors” nowadays. Use commonsense — if your auditor is known for having several contracts hacked after being assigned a “secure” stamp, maybe it’s not the best auditor.</li></ol>Callisto Network has been a truly independent security auditor since 2018. We focus on promoting the best security practices to minimize the amount of funds that any crypto users may lose.We believe that cryptocurrency adoption is impossible without fault-tolerant services such as those available in existing banking applications.Join the Callisto Network Community on <a href="https://twitter.com/CallistoSupport" rel="noopener noreferrer nofollow">Twitter</a>, <a href="https://t.me/CallistoNet" rel="noopener noreferrer nofollow">Telegram</a>, <a href="https://www.reddit.com/r/CallistoCrypto/" rel="noopener noreferrer nofollow">Reddit</a>, and <a href="https://clo.click/Discord" rel="noopener noreferrer nofollow">Discord</a>.

Curve Finance Hack: A Deep Dive into the Vyper Vulnerability

Table of Contents

Callisto Network

Other articles published on Aug 3, 2023

Intella X Joins Hands with Chainlink Labs to Enhance Security

Cardano Community Dispels ‘Ghost Chain’ Myths: Strong Evidence Shuts Down Accusations

Binance starts BTC/FDUSD and ETH/FDUSD trading pairs with zero-fees

COMPTE À REBOURS H-8 : à quoi s’attendre lors du Halving Litecoin (LTC) ?

Bridgecoin Allows Crypto Capital Gain Deferment

Ukraine claims $81m tax gap from unregulated crypto exchanges

Join our free newsletter for daily crypto updates!