Latest DeFi exploits show audits are no guarantee

Two recent catastrophic exploits of two DeFi protocols differed in many ways, yet shared one commonality — both were audited multiple times.

Raft Finance, a stablecoin provider inspired by Liquity but backed by staked ether, fell victim to an infinite mint bug two weeks ago. KyperSwap saw its liquidity pools drained on Nov. 23.

The Raft team’s post-mortem analysis of the incident pointed out that, “the exploited Raft smart contracts were audited by Trail of Bits and Hats Finance. Unfortunately, the vulnerabilities that led to the incident were not detected in these audits.”

Kyber Network similarly flagged its platform’s audits from vaunted security experts, including 100proof, ChainSecurity and participants in an audit competition organized by Sherlock.

Raft procured even more audits by Curious Apple and Aviggiano throughout 2023, indicating ongoing security evaluations and improvements​​ that have led onlookers to question the assumption that an audited protocol is necessarily safe.

Read more: Raft Finance floats user bailout plan after odd exploit

What’s needed is a “paradigm shift” in how blockchain projects tackle threats in the face of examples like these, says Halborn’s chief operating officer Dave Schwed, highlighting “sophisticated manipulation of smart contract functions.”

“It highlights the importance of projects taking a proactive and layered approach to security, beyond just relying on external audits,” Schwed told Blockworks.

Other smart contract specialists, including Yearn Finance security researcher Storming0x, concur. They said on X that it’s “a waste for a project to get an audit” absent attention to other best practices.

It is also difficult for ordinary users to tell whether an audit covers the final code in production.

The Devil vulnerability is in the details

Theoretically, a user could compare the audited code with the current published version, Schwed noted.

“Most audit reports show, or should show, a hash of the repo of the code that was audited,” he said. “There should be some automated mechanism to compare the code audited and the code in production enhancing transparency and trust.”

Michael Lewellen, head of solutions architecture at Open Zeppelin, noted that “change management” — ensuring the production version matches the audited one — was not an issue in Raft’s case. However, he does see a tendency for some development teams to ignore the advice of their auditors.

“Trail of Bits, despite missing the bug itself, did note in their report that the Raft codebase could have made improvements to their testing and verification,” Lewellen told Blockwoks.

“These recommendations should not be taken lightly by projects that might otherwise assume the audit report gives them the all-clear to launch without making improvements to other parts of their security stack,” he added.

Making users partly whole

After receiving feedback that it was unfair to exclude those who sold their R following the depeg event, Raft retracted its initial recovery plan.

A revised “recovery plan” was published Friday, giving victims until the end of March 2024, recoup a portion of their losses.

“After substantial feedback from the Raft community, the Raft Recovery Plan has been finalized, resulting in a 42% recovery rate. This guide is for all the affected users who were included in the Raft Recovery Plan to claim their DAI,” the plan said.

For Kyber the scale of the loss was significantly greater — some $48 million. The road to recovery is still unclear.

The KyberSwap exploit, noted for its unusual sophistication, has left DeFi users wondering about the level of yield that justifies their risk-taking.