2024

DeFi

Security

Security is becoming a concern once again, as DeFi protocols and Web3 projects have grown their liquidity. More complex decentralized systems open new possibilities for attacks and exploits.&nbsp; 
Several high-profile protocols will fund research and events for Web3 security, which also affects DeFi protocols. Among them is MakerDAO, with a direct investment into SherlockDeFi, a firm specializing in the security of decentralized protocols.&nbsp; 
Also Read: <a href="https://www.cryptopolitan.com/certik-ethical-hacking-kraken-full-return/">CertiK explains ethical hacking stance, Kraken admits full return of funds</a> 
In the case of Sherlock, the organization offers multiple targeted challenges for using and auditing DEX or other apps. The <a href="https://x.com/sherlockdefi/status/1805580157001871381" rel="nofollow" target="_blank">MakerDAO challenge</a> is the biggest so far, with a bounty that is 10X the usual pool for SherlockDeFi.&nbsp; 
Sherlock has worked with established Web3 security experts, and has closed 167 <a href="https://audits.sherlock.xyz/contests?filter=finished" rel="nofollow noopener" target="_blank">audit events</a> so far. Sherlock’s audits claim to have prevented 383 critical bugs, caught before mainnet launches for multiple projects. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 It is shaping up to be a Web3 security summer. 
 – <a href="https://twitter.com/CodeHawks?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@CodeHawks</a> is bringing a new competition everyweek in july – <a href="https://twitter.com/MakerDAO?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@MakerDAO</a> $1.35 million on <a href="https://twitter.com/sherlockdefi?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@sherlockdefi</a> – <a href="https://twitter.com/immunefi?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@immunefi</a> is hosting a million dollar attackathon 
 — funk-or-naut (@funkornaut) <a href="https://twitter.com/funkornaut/status/1806340008724316424?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">June 27, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
<h2 id="span-style-font-weight-400-exploits-accelerate-leading-to-web3-security-summer-span">Exploits accelerate, leading to Web3 security summer</h2> 
In June alone, the crypto world witnessed two high-profile exploits – UwU Lend, which lost $20M through a smart contract, and Kraken’s $3M ethical hack by Certik. The Velocore exchange also lost $6.8M in attacks against its ZKSync and Linea pools. In June, ImmuneFi recorded 12 incidents, which took away as much as $78M. 
Also Read: <a href="https://www.cryptopolitan.com/kraken-recovers-funds-stolen-by-certik/">Kraken recovers $3M as criticism mounts against CertiK</a> 
According to ImmuneFi, Q2 arrived with $509M in exploits, a 91% increase compared to the same period of 2023. Exploits and hacks slowed down during bear markets, but immediately grew as DeFi increased its holdings. In 2024, there were a smaller number of hacks, but more carefully targeted to specific protocols and their weaknesses. 
DeFi has grown in complexity, spreading to several L2 chains. The bridges, smart contracts and wrapped assets open the door for exploits. The other big source of theft are MEV attacks, or sandwich attacks, which aim to front-run DEX traders.&nbsp; 
ZachXBT, a high-profile researcher of blockchain exploits, recently exposed a MEV attacker.&nbsp; 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 As an update I am pleased to share that Robert Robb aka <a href="https://twitter.com/pokerbrat2019?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@pokerbrat2019</a> just plead guilty on Friday for his MEV bot investment fraud scheme and now faces up to 20 years in prison. 
 In December 2023 I made a post detailing 11+ investors who were victimized and revealed his… <a href="https://t.co/1Sdj7B2pUJ" rel="nofollow" target="_blank">https://t.co/1Sdj7B2pUJ</a> <a href="https://t.co/zHYc4jzPBa" rel="nofollow" target="_blank">pic.twitter.com/zHYc4jzPBa</a> 
 — ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/1805258560705831209?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">June 24, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
Solana and Jito DAO also aim to slow down MEV activity and allow retail traders to post orders that will not be attacked.&nbsp; 
The other big class of attacks and exploits to Web3 users include attempts to drain individual wallets. Funds from wallets can be taken through injecting faked addresses, malicious smart contracts or fake NFT buying links.&nbsp; 
<h2 id="span-style-font-weight-400-competitions-and-bounties-draw-in-web3-developers-span">Competitions and bounties draw in Web3 developers</h2> 
ImmuneFi is also offering both distance and in-person challenges for security experts. ImmuneFi made a call to developers for a live event in Brussels, during a general DeFi security event. ImmuneFi has established itself as one of the go-to platforms for new paid opportunities and ethical hacking.&nbsp; 
The launch of multiple new Web3 and DeFi protocols helped ImmuneFi draw in more ethical hackers. In June, the aggregator reached a milestone with $100M paid out to bug hunters. 
Also Read: <a href="https://www.cryptopolitan.com/crypto-hacks-and-scams-doubled-in-q2-2024/">Crypto hacks and scams doubled in Q2 2024: Report</a> 
ImmuneFi set up a bounty of up to $5,000, available during the July 8 challenge in Brussels. ImmuneFi is also constantly aggregating bounty and test opportunities for security experts. The platform brings bounties of all scales, covering both niche smart contracts and large protocols.&nbsp; 
One of the biggest bounties in the DeFi space is that of Morpho, an aggregator of lending pools. Morpho aims to protect $1.85B in value locked, recently reaching an all-time high. For that reason, Morpho expanded its bug bounty vault to $2.5M. Morpho made a direct call to test specific smart contracts that make the backbone of its activity.&nbsp; 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 The new maximum bounties for Morpho's smart contracts: 
 Morpho Blue: $2.5M Morpho Blue periphery contracts: $1.5M MetaMorpho: $1.5M Morpho Optimizers = $555k 
 Learn more about the bounty on <a href="https://twitter.com/immunefi?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@immunefi</a> 👇<a href="https://t.co/YqWxwIzQea" rel="nofollow" target="_blank">https://t.co/YqWxwIzQea</a> 
 — Morpho Labs 🦋 (@MorphoLabs) <a href="https://twitter.com/MorphoLabs/status/1806314497943994869?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">June 27, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
According to Certik, almost all Web3 protocols contain still-undiscovered risks. Certik’s standards place the Wemix <a href="https://x.com/CertiK/status/1805997508205940898" rel="nofollow" target="_blank">wallet and ecosystem</a> as the safest possible in Web3.&nbsp; 
Additionally, the summer of 2024 brought a near-constant wave of new tokens. Now, DEX, wallets and other services are trying to build whitelists and quickly flag potential risky tokens and rug-pulls. 
The Code Hawks event will start with TempleDAO, from July 4. Each week in July, a new competition will open with a bounty for a different platform. The TempleDAO audit will have a prize pool of 25,000 USDC for successful bug hunters. Code Hawks aims to continue involving big protocols, while building a leaderboard of the best bug hunters. 
Cryptopolitan reporting by Hristina Vasileva

Web3 and DeFi protocols gather to increase sector’s security

Table of Contents

Cryptopolitan_News

Other articles published on Jun 28, 2024

Pepe Coin’s Price Rebounds While New Layer-2 Meme Coin Presale Sets Up for Major Gains

Spot Solana ETF could cause a surge in SOL price by 9x

Best Crypto To Buy: Three Altcoins Destined To Be Future Top 5 Stars

Ethereum Name Service to halt at $27? What ENS investors need to look for

Sail With MoonBag Staking: Enjoy 88% APY Rewards, Outshining Ripple (XRP) and Cardano (ADA) in it...

Forget the FOMO! MoonBag Top Crypto Presale in 2024 Triumphs as Arbitrum and BlastUp Falter

Join our free newsletter for daily crypto updates!