Reflection on the BXH coin theft case: Hackers "destroyed" the domestic machine gun pool in the most primitive way. What are the reasons and lessons?

Wu Shuo Author | Wu Zhuocheng

Editor of this issue | Colin Wu

On October 30, the decentralized yield protocol BXH suffered a private key theft incident, resulting in a loss of approximately $139 million worth of crypto assets. The security incident occurred on the BSC chain. According to the official statement, the on-chain assets of Ethereum, OEC and Heco were not affected, but for security reasons, the deposit and withdrawal functions on all chains were closed.

After the incident, according to the analysis of blockchain security agency SlowMist Technology, the hacker deployed the attack contract 0x8877 ​​at 13:00 (UTC) on the 27th, and then the BXH wallet address 0x5614 granted management permissions to the attack contract 0x8877 ​​through grantRole at 8:00 (UTC) on the 29th. At 3:00 (UTC) on the 30th, the attacker transferred the assets under his management from the BXH vault through the permissions obtained by the attack contract 0x8877. At 4:00 (UTC) on the 30th, the wallet address 0x5614 suspended the vault. Therefore, the theft of BXH this time was due to the malicious modification of its management permissions, which led to the attacker using this permission to transfer project assets. At present, 4,000 ETH in the hacker's initial address (0x48c94305bddfd80c6f4076963866d968cac27d79) has been transferred from BSC to ETH, and 300 BTCB has been converted into renBTC and transferred to new addresses (1Jw...9oU and 1Fr...Vow). Blockchain security agency Paidun announced on Twitter the whereabouts of the stolen funds as of November 1:

As soon as this incident came out, public opinion was in an uproar. Everyone was wondering why BXH could hand over the fund management authority to hackers. Hackers did not need to conquer complex smart contracts, but only needed to obtain private keys to destroy the entire protocol. This method of stealing coins is quite primitive, which inevitably makes people wonder whether there is an insider. Subsequently, a series of black histories about the founder were also exposed. At present, the official only stated that this incident was a private key leak, and issued a $1 million bounty to recruit white hat teams to recover the funds.

However, the turmoil did not end there. Since BXH has closed the withdrawal function, the machine gun pool project that relies on it to generate income has also been forced to shut down the withdrawal function. Currently, four machine gun pools have been implicated, and the first to bear the brunt is Coinwind, which ranks second in locked positions on Heco (the associated amount is as high as 150 million US dollars). The Coinwind team said that it is fully following up on the recovery of BXH’s stolen assets, the loss situation, the time for opening deposits and withdrawals, and the progress of the asset withdrawal plan.

Moreover, due to the high amount of Coinwind locked in Heco, other small-scale machine gun pools will directly choose to lock funds in Coinwind and use leverage to amplify the returns in a "lazy operation", so such projects are naturally not immune in this incident. The problems reflected behind this phenomenon are worth pondering.

At present, the profit model of the machine gun pool is to constantly look for various high-yield lending agreements, and then frequently deposit and borrow money to earn platform tokens, and finally amplify the leverage multiples through boosting, using this "Lego building" method to present exaggerated returns to investors. Of course, this method amplifies the returns while also amplifying the risks. The loss of principal at any level may cause the entire Lego to collapse.

Therefore, every step of the machine gun pool and the destination of every fund should be disclosed at all times, just like the public offering fund discloses its holdings, so that investors can make their own choices. Taking Yearn as an example, the investment strategy and destination of each fund pool in its machine gun pool need to be discussed and voted by the members of the DAO organization, and finally the strategy will be announced. If the user is not satisfied with the investment strategy of a fund pool, he can choose not to invest. However, many other machine gun pools do a very poor job in openness and transparency, especially domestic projects, which have a lot of black box operations. In this incident, some users were dissatisfied with CoinWind's investment of assets in the controversial BXH. They said that if they knew in advance, they would not deposit their assets in CoinWind. CoinWind's response was that they had done due diligence on BXH, and there was no problem with BXH's audit report. This time BXH was attacked because the private key was stolen, which was an irresistible risk. However, after checking the audit report that SlowMist made to BXH in March, it was found that:

(SlowMist also stated that the subsequent BSC audit was not completed by them. The subsequent audit seems to be completed by Lingzong Security)

At present, the machine gun pool only operates in cycles between various lending protocols to amplify the returns. From the perspective of traditional finance, this is obviously impossible to develop sustainably. In the traditional world, only banks or some large institutions (such as real estate developers) can cycle lending to amplify the money multiplier. Ordinary people cannot do this due to regulatory restrictions. There is no regulation in the DeFi world, so retail investors can cycle lending like institutions. Many users even think that this is a product unique to DeFi, but in fact it is not. It is natural that regulators do not allow retail investors to operate in this way. After all, most ordinary people have weak risk control capabilities.

This is also the biggest risk of current machine gun pool products. They are mainly divided into three categories according to the level of risk:

• Low risk – simple strategy – single asset collateral vault (i.e. single stablecoin staking)

• Medium risk – Simple strategy – Automatic compounding of liquidity tokens and platform tokens

• High Risk – Advanced Strategy – Multi-layered strategy using multiple protocols for circular lending (taking Yearn as an example)

Different types of strategy pools have different risk levels. Usually, the risk of impermanent loss of a single-asset strategy pool is lower than that of a strategy pool that requires liquidity tokens as deposit assets. In this coin theft incident, the public's focus is on contract security risks, which is actually a common problem for blockchain products. However, the existence of machine gun pools amplifies this risk. Every time a new protocol is added to the strategy, a layer of hacker risk is added. Any problem in any link will affect the entire machine gun pool. I personally think this is what deserves the most attention.

There are now some agreements based on option combination strategies, synthetic asset arbitrage and other traditional financial products. These products have been proven to be sustainable in the traditional field. Of course, participating in these products requires a higher technical threshold, which is the value of institutional investors. It is reasonable to leave professional matters to professionals in any field. This is also the future development direction of the machine gun pool. The current circular lending is really low in technology. In this way, it is not an insult to these "Lego-style" machine gun pools in China that hackers use this rather primitive and seemingly low-tech theft method.

(Due to the adjustment of the public account push logic, old readers please add a star to Wu Shuo's public account to avoid not receiving it. How to add a star: How to set a star for a public account)

According to the "Notice on Further Preventing and Dealing with the Risks of Virtual Currency Trading Speculation" issued by the central bank and other departments, the content of this article is only for information sharing and does not promote or endorse any business or investment behavior. Readers are requested to strictly abide by the laws and regulations of their region and not participate in any illegal financial behavior. Wu said that the content is prohibited from being reproduced or copied without permission, and violators will be held accountable.