How to Prevent Your Defi Project From Hacking?

Screenshot (33).png

The total value locked in DeFi ecosystem increased to $85 Bn in May 2020 from $888 Mn a year ago. DeFi is successfully gaining investors’ trust.

Such a fast-growing market is bound to gather a lot of attention from hackers. Although cryptocurrency cybercrime was down by 60% in 2020, the share of the DeFi space in crypto hacks volume increased to 21%. 

Major DeFi Exploitation YTD 

Before understanding how one can prevent these DeFi attacks, it is pertinent to know why those attacks happened.  

image002 (1).jpg

(Source: Medium) 


Consider this, you owe Jessica $1, and you have 10$ in your wallet. You tell Jessica to take $1 from your wallet, which is lying on the table. Jessica takes out $1 when you are not looking. Since you have not seen Jessica taking out $1 from your wallet, you believe you still owe her, and you let your wallet stay on the table. Jessica keeps repeating the process, taking out $1 each time when you are not looking. Finally, she takes out the last $1 from your wallet, and you see that. For you, she has taken out $1 only, but when you check your wallet, all your money is gone. This is a reentrancy attack. Jessica kept reentering your wallet without letting you know that the transaction has closed.  

 Sharp Fall in TVL of dForce due to the reentrancy attack

dForce protocol suffered a reentrancy attack to the tune of $ 25 Mn on its smart contract using ERC-77 token standard. ERC-77 is an extension of ERC-20 and not vulnerable by itself. However, dForce used a combination of decentralized protocol and ERC-77 to offer lending services on the Ethereum platform. This combination of Ethreum’s code with Defi Protocol inadvertently opened the doors for the exploit.   Source: Defi Pulse 


Lately, flash attacks have become the most popular method of hacking. A flash loan is a loan that is valid within only one blockchain transaction and doesn’t have default risk. It means that the lender agrees to loan any amount to the borrower provided the amount is returned to the lender within the given time,  or else the lender can roll back the entire transaction. The hackers circumvent the loan mechanism, which opens up various vulnerabilities such as asset price manipulation.  

DeFi protocol Harvest suffered from smart contract vulnerabilities visible in a lack of arbitration function moderation. Here is a breakdown of what the hacker did: Detected an arbitrage opportunity,Used a flash loan function on Uniswap (v2), Manipulated the value of stable coins to his favor on protocol and Harvest Finance,  Withdrew more coins than he deposited, thus draining the pool.  Lastly, repeated the process many times and led to a total loss of $24 Mn in stable coins. Source: DeFi Pulse 


Smart contract execution relies on accurate data provided by price oracles. However, getting this price data is not as secure and reliable as one would want it to be. If the oracles push incorrect data, the smart contract will lead to faulty execution. This fact favors hackers who try to manipulate prices to their advantage.  


A case in point was Ethereum on the “Black Thursday” when its network became congested due to a price crash. The panic attracted many malicious actors who started spamming the network, resulting in oracles struggling to give the most updated price information and manage liquidations. Some bad actors exploited the opportunity by liquidating some of their loans for free, aggregating a loss of $8 Mn.  


Now let us understand DeFi attack types. 


Coding mistakes arise out of carelessly executed smart contract security audits or unchecked smart contract loopholes and vulnerabilities. Regrettably, many blockchain project founders decide to run their projects with insufficient coverage of unit tests and overlook the relevance of security audits. 

This negligence leads to an increased possibility of an attack and loss for investors.  


Sometimes, even security audits cannot reveal vulnerabilities due to inexperienced staff, lack of knowledge of the business process, and at times, because the problem does not lie in the smart contract. It happened in the case of the Harvest attack, where the risk exposure was in the protocol infrastructure.  


To clarify, the developers’ team or any third party does not create your private key; you create it.  

 As a founder, one should be cautious while creating positions within a project. Many project owners create a position such as “protocol admin” and give them access to private keys. Such a practice is not recommended unless limited access to the keys and smart contract function is given. Alternatively, one may build the system in a way that even if one of the administrative accesses is compromised, the entire system does not bear the brunt of a hacking attack. One way of doing it is decentralization and segregation of duties. In other words, do not give full access to a single system operator.  


On 20 July 2017, an unknown attacker exploited a vulnerability in the Parity multi-signature wallet on the Ethereum network. The result was a drain of $31 Mn from three accounts. Had the white-hat hackers not rung the alarm bell by withdrawing money from the remaining exposed wallets, the loss could have been $180 Mn.  

A multi-signature wallet can be unlocked by using several private keys and not just one key. The attackers uncovered a vulnerability in the default smart contract code of Parity multi-sig wallets. They simply found a programmer-introduced bug in the code that let them reinitialize the wallet (just like one restores a device to factory settings), and set themselves up as the new owners, allowing them to walk away with all the money.  

The Parity contracts were audited various times by different players, yet the attack happened. This attack was caused by a lack of awareness, acknowledgment, and failure in understanding the system architecture. A team of experienced developers with a deep understanding of system architecture is indispensable in preventing a hack. 


Although by now, the readers must be aware of what to do and what not to do to protect their project, we will still mention it here in terms of steps. Please note that these measures only reduce your risk and are not a fool-proof way of protecting your project.  


It helps to remove flaws and vulnerabilities at the very beginning and reduce the chances of significant losses. The thing to remember is “full” unit test coverage, not just 65% or 70%, or enveloping only “the most significant parts of contract”, as a chain is as strong as its weakest link.  


““I am and always will underline the importance of smart contracts auditing. Do not try to reduce the development time  trying to reduce the time for audit or full test coverage. Remember, if you don’t check your project, the hacker surely will! ””

— Sergey Onyshchenko, CEO of Blaize 

Even though a security audit does not fully secure the project from hacking attempts, it does a good job of finding out improvement areas overlooked in full unit test coverage. 


One audit alone cannot uncover all the shortcomings; therefore, a secondary audit is a must before project deployment. A case in point is the dForce protocol, which could have avoided an unfortunate incident if it had audited all possible paths.   


Continuing with the dForce example, it is worth noticing that the dForce contract pattern has a similar structure to the earlier Compound contracts. It proves that copying codes of other protocols will not safeguard your DeFi project. When one copies a code, he/she has to retrofit the project’s requirement to the code, leaving gaps and incompatibilities on the way. These are the main reasons for future exploits.  


To prevent the loss of private keys, we recommend using the multi-sig scheme. There are two ways of introducing this scheme in your contract: creating a separate multi-sig contract and creating a multi-sig login within a protocol. 


Even if your unit test and security audit fail to address the exploits, a talented team of developers is absolutely essential to prevent a hack or reduce the amount of loss.  


Lastly, turn on your protocol community. Engage with a dedicated audience to help you reduce your flaws and shine. Initiate bug bounty programs. It will encourage users to report vulnerabilities and improve their user experience.  

Are you a new blockchain project or an old company looking for ways to get 360 degree coverage for your project from hacking and exploitation attempts? Admantium Crypto Advisors specializes in helping blockchain businesses like yours in preventing your project from hacking attacks in this fast-moving industry. We understand the uniqueness of your project and hold your hand throughout the process.  

Reach out at to discuss your project with our director. 

About the author- Nitya

Nitya is a Senior Financial Analyst at Admantium Crypto Advisors, an investment banking and consulting firm focused on blockchain technologies. We help early-stage entrepreneurs and startups in Building Business Models and Developing Business Ideas take a 360-degree view of how to build a sustainable business using blockchain technologies, translating concepts into clear-cut plans. We also help raise external funding to kickstart or grow your business.


Leave a Comment

Your email address will not be published.