Another day, another DeFi hack. Heard that before? Probably a lot these days.
Hacks and rug pulls are not uncommon in the DeFi ecosystem. And yet, the space continues to see sustained growth over an extended period. The Pickle Finance incident, ideally, should have been just another one of these hacks. However, increasingly, it seems that the hack that took place over the weekend was different in quite a few ways.
DeFi protocol Pickle Finance was hacked on Saturday, with hackers gaining access to $19.7 million DAI. Following the hack, Pickle Finance’s token, PICKLE, fell by over 50%. Here, it would appear that Pickle Finance’s cDAI jar was hacked following a vulnerability involving fake Pickle Jars.
However, this wasn’t the usual Flash Loan attack that several other DeFi protocols like Harvest Finance and Akropolis faced earlier this month.
In fact, closer investigation by a few players revealed that the hacker wasn’t someone merely exploiting an obvious bug in the code. Instead, this was something even more sophisticated.
In a recent report, REKT revealed that the attacker had excellent knowledge of Solidity and EVM, and had likely been paying close attention to the Yearn code for some time as the vulnerability was similar to the one which was discovered in the Yearn code a month earlier.
In fact, a developer on Twitter identified and outlined how 8 flaws that were utilized in this exploit all had to occur at the same time in order for the attacker to succeed. That’s not all either as reportedly, the code in question was left out of an audit that just took place.
8/ I would say what pickle intended to do was nothing wrong. They wanted to make `swapExactJarForJar` generic and user-friendly. The problematic part was that all 8 flaws HAPPEN AT THE SAME TIME, and all used not in an intended way. That's why I said it's like a traditional CTF.
— orb_x_ball (@orbxball) November 22, 2020
While mitigating the attack, the withdrawal request had to pass through the Governance DAO which had a 12–hour timelock. However, the only member of the Pickle multi-sig that had the ability to bypass the timelock was asleep.
Soon, warnings were sent out to users to withdraw their funds immediately by Pickle Finance and Curve as the white hat team investigated the exploit and checked the safety of the remaining funds. By then, however, it was too late.
Interestingly, the aforementioned report also made one astute observation in its report,
“By releasing this technical information, we are aware that we could be triggering new hacks.”
Later, protocols running forked versions of Pickle’s code were advised to be aware of the unfolding events, while also taking preventative action against copycat hacks.
