Latest DeFi exploits show audits are no guarantee

What’s needed is a “paradigm shift” in how blockchain projects tackle threats in the face of examples like these, says Halborn’s chief operating officer Dave Schwed, highlighting “sophisticated manipulation of smart contract functions.”

“It highlights the importance of projects taking a proactive and layered approach to security, beyond just relying on external audits,” Schwed told Blockworks.

Other smart contract specialists, including Yearn Finance security researcher Storming0x, concur. They said on X that it’s “a waste for a project to get an audit” absent attention to other best practices.

IMO is a waste for a project to get an audit without good testing, coverage, fuzzing and at least 1 good peer review.

Why? Because a good auditor will find most evident high issues at surface given the small amount time but not have time to go in depth.

7/ pic.twitter.com/t64H0RVtC2

— Storm Blessed 0x (@storming0x) November 14, 2023

It is also difficult for ordinary users to tell whether an audit covers the final code in production.

The Devil vulnerability is in the details

Theoretically, a user could compare the audited code with the current published version, Schwed noted.

“Most audit reports show, or should show, a hash of the repo of the code that was audited,” he said. “There should be some automated mechanism to compare the code audited and the code in production enhancing transparency and trust.”

Michael Lewellen, head of solutions architecture at Open Zeppelin, noted that “change management” — ensuring the production version matches the audited one — was not an issue in Raft’s case. However, he does see a tendency for some development teams to ignore the advice of their auditors.

“Trail of Bits, despite missing the bug itself, did note in their report that the Raft codebase could have made improvements to their testing and verification,” Lewellen told Blockwoks.

“These recommendations should not be taken lightly by projects that might otherwise assume the audit report gives them the all-clear to launch without making improvements to other parts of their security stack,” he added.

Making users partly whole

After receiving feedback that it was unfair to exclude those who sold their R following the depeg event, Raft retracted its initial recovery plan.

A revised “recovery plan” was published Friday, giving victims until the end of March 2024, recoup a portion of their losses.

“After substantial feedback from the Raft community, the Raft Recovery Plan has been finalized, resulting in a 42% recovery rate. This guide is for all the affected users who were included in the Raft Recovery Plan to claim their DAI,” the plan said.

For Kyber the scale of the loss was significantly greater — some $48 million. The road to recovery is still unclear.

9/ We are grateful for the overwhelming support from those who have offered assistance in aiding in the investigation. Our heartfelt appreciation goes out to our users & partners who believe in our product & mission. Updates will be provided as the situation unfolds.

— Kyber Network (@KyberNetwork) November 24, 2023

The KyberSwap exploit, noted for its unusual sophistication, has left DeFi users wondering about the level of yield that justifies their risk-taking.

Source