Incident Analysis of PolyNetwork Breach

PolyNetwork Breach : Incident Analysis – FIN 545 With the advent of blockchain, Cryptocurrencies have emerged as a great alternative to transactions in traditional fiat currencies, therefore, a potentially powerful democratizing force that can increase inclusion and allow fast transactions without any intermediary involved.

Considering the advancements in this domain and its associated use cases, it’s still at its nascent stage of development where there’s a substantial scope to improve upon the security and integrity that the platform provides. This case specifically deals with recent breach of PolyNetwork resulting in a loss roughly equivalent to $610 million in the form of Cryptotokens of Ether, Binance-coin and USDC which was then exfiltrated to external wallet addresses.

According to the Blockchain security firm SlowMist and security Researcher Kelvin Fichter, “the hack was made possible by a mismanagement of the access rights between two important Poly smart contract. The first one is ‘EthCrossChainManager’ and the second one is ‘EthCrossChainData’ ”. SlowMist in a statement on twitter, relayed their initial findings in the wake of the attack, claiming “ Our security team has grasped the attacker's mailbox, IP, and device fingerprints through on-chain and off-chain tracking, and is tracking possible identity clues related to the Poly Network attacker." In the same thread, the firm claimed that the hacker’s initial source of funds was Monero, which was later exchanged for other tokens which were used to fund the attack. SlowMist also specifically pointed out that by the nature of the attack which was carried out, combining the data associated with the flow of funds and multiple fingerprint information, it was evident that this was a carefully planned, organised and prepared attack. This was arguably the biggest attack in Defi history. By the series of events that unfolded since the breach, its quite important to note that there was a technical flaw in securing the very privileged cross-chain smart contract which was successfully exploited by 1

the attacker who was a complete outsider. The attackers main motivation was to commit cyber theft and eventually make a name for himself for pulling off the biggest hack in Defi history, but the prompt action by the administrators of Ether and other Crypto-tokens of freezing and blacklisting the stolen funds, made it extremely difficult for the attacker to launder them through the Curve liquidity pool and exchanging then for fiat currency, hence he decided to return the stolen assets as an easy way out.

To understand the intricacies of the attack, we need to delve deep into the nature of blockchain and the associated inherent issues with Cryptocurrency exchanges that PolyNetwork intends to solve. A common problem that arises while exchanging Cryptocurrency is when we own a certain kind of token (say Bitcoin) and want to convert it to another token that uses a different kind of blockchain technology or consensus(say Ripple) which attracts exchange and gas fees.

Hence this leads to creation of cross-chain interpreters and thus need to create a cross-chain Network which would basically act as an abstraction layer on the concept of distributed virtual machines. To be more precise Cross-chain Networks require their own virtual blockchain to run smart contracts that govern the communication rules within the underlying transaction and exchange networks of two or more Crypto-tokens in a distributed and autonomous way.

PolyNetwork is basically a Cross-chain network that manages and governs the underlying exchanges of different Crypto-tokens such as Bitcoin, Ethereum and Elrond in a form of smart contracts.

To give a brief overview of its architecture, PolyNetwork can be described by the following components: •

A master wallet address that corresponds to each one of the underlying Layer1 networks (e.g., one for Bitcoin, one for Ethereum, one for Elrond …) each of them containing a certain amount of funds.

2

•

A set of smart contracts that interpret and execute users’ instructions (e.g. “please exchange this amount of Bitcoin that I am sending to you into Ether tokens”) by calling functions through APIs’ on the related above wallets.

•

A virtual blockchain abstraction layer (the PolyNetwork itself) where the above smart contracts run.

Diagrammatic Representation of the Cross-chain transaction process withPolyNetwork

The attacker happened to exploit two specific vulnerabilities within the PolyNetwork smart contract, the first one being that EthCrossChainManager had access to execute priviledged functions within the domain scope of EthCrossChainData as it had owner rights. Second one being related to a function snippet that needs to be called by the EthCrossChainManager which is a specific 32 bit solidity function ID in order to execute a target Poly Contract, the function snippet is stated below as: “`bytes4(keccak256(abi.encodePacked(_method,“(bytes,bytes,uint64)”)))`” According to reports by Blockchain security firm SlowMist who were able to determine the root cause of the attack, the second vulnerability was associated with the “_method” part in the 3

function snippet above which is actually user defined, therefore can be modified and set at will, which allowed the attacker to brute force the method field for a 32 bit value obtained by hash collision to exfiltrate the public key ID by calling the putCurEpochConPubKeyBytes function.

Slowmist ascertained the root cause as: “1. The source chain did not check the initiated cross-chain operation.

2. The target chain did not check the parsed target call contract and call parameters.

3. The owner of the `EthCrossChainData` contract is `EthCrossChainManager`.

4. `bytes4(keccak256(abi.encodePacked(_method,“(bytes,bytes,uint64)”)))` can be collided by hash.”

Just moments after the breach had taken place, deviating from its usual narrative of “its all decentralized, and nobody can do anything about it”, Poly Network requested and pleaded with the miners and Crypto-exchanges to collaborate and figure out ways of recovering from the largest heist in Defi history. They immediately urged all parties involved to freeze the attackers’ addresses and exit routes through which the stolen crypto funds could be cashed out thus prohibiting the hacker from moving and laundering the stolen funds.

In response to the SoS calls meted out by PolyNetwork, Tether was one of the first to respond, they took action by freezing 33 million dollars worth of Stolen USDT tokens on the Ethereum chain just before the hacker could try to launder it through Liquidity Curve. While Binance CEO stuck to his decentralization narrative that ultimately there’s no regulating body for Binance Smart Chain and therefore is controlled by none. He claimed he would do whatever he could with “no guarantees” as stated on popular journals and news platforms. PolyNetwork had also reportedly threatened the attacker of legal consequences as they would be eager to pursue the matter legally and develop a case against the hacker of cyber theft if the stolen 4

Crypto-funds were not returned back to their original wallet addresses since the money ultimately belonged to the masses. They even tried to bait the attacker by terming him as “Mr White hat” and promised to reward him with Five hundred thousand dollars as a bounty for fully returning the stolen funds, which the attacker refused to accept eventually.

By intervention of the Crypto-exchanges and blockchain community , lots of stolen funds in forms of Crypto tokens were identified, blacklisted and frozen which ultimately left no choice for the hacker but to return back the amount as it was extremely difficult for him to liquidate the stolen funds through the Curve as fund tokens were blacklisted and tagged therefore most of the exit routes were monitored by analytic tools. Any wrong move would have given off clues and imprints that could have traced backed to him. SlowMist also claimed to have identified the hacker’s wallet addresses and the breach fingerprints. The operations were restored by PolyNetwork and the loop holes in the smart contract backend were patched once the stolen funds were fully retrieved.

Since the PolyNetwork hack was the biggest in Defi history , it has obviously created ripples across the blockchain and Cryptocurrency world, voicing the need for stronger regulatory compliance and enforcing the policies that protect user and client interests. The onus lies with the big fishes within the blockchain industry who are investing deeply into this space, to create and stable and secured environment for small time investors and newcomers for this space to grow and sustain itself in the near future. Due to the nature of Cryptocurrencies being decentralized and largely unregulated across the globe, there’s a clout of uncertainty among seasoned investors and newcomers regarding their investments as the Crypto-market is uncertain and highly volatile and also retracing and retrieving their money in case of orgasnised cyber thefts and fraud. The PolyNetwork breach could have been theoretically prevented by implementing a modular backend architecture for the Poly smart contract, such that the process flow of every critical function chain should be independently executed, privilege access rights 5

should be time and priority oriented, also slot gaps should have been implemented such that the access right can be deescalated due to certain intervals of inactivity. The only positive side to such breaches is the assurance of the fact that institutions and conglomerates such as PolyNetwork would invest heavily in Cybersecurity research and would continuously employ people to do penetration or exploit testing thus contributing and promoting towards education and research. Having their data compromised is bad PR and detrimental towards attaining customer goodwill in the long run.

Implementing a regulating and protecting body like FDIC (in case of fiat currencies) is also required despite the call for decentralization and freedom, pertaining to Cryptocurrencies, as fraud, money laundering and organised theft can be recorded, addressed and kept in check.

Strong encryption and multifactor authentication should be enforced with regular validation trials.

As the biggest hack in Defi history, the amount of monetary loss in terms of Crypto-tokens spread like wildfire in public domain which was evident as several newspapers, media houses and journals reported the breach. The popularity of the Crypto-market coupled with public hype and trend regarding Crypto-investments contributed towards its publicity. The total amount of stolen funds were deemed to be around 610-620 million dollars which is an enormous amount to begin with. The institutional definitely suffered huge losses through associated bad PR and indirect business losses even though it managed to retrieve all of its stolen funds.

Debshikhar Das M.S. in Cybersecurity.

6

References https://time.com/nextadvisor/investing/cryptocurrency/poly-network-hack/ https://cointelegraph.com/news/poly-network-hack-exposes-defi-flaws-but-communitycomes-to-the-rescue https://coingeek.com/poly-network-attack-heres-what-happened-to-biggest-defi-hack-inhistory/ https://slowmist.medium.com/the-analysis-and-q-a-of-poly-network-being-hacked8112a35beb39 https://www.bankinfosecurity.com/poly-network-says-600-million-in-cryptocurrency-stolena-17255 https://www.elliptic.co/blog/the-poly-network-hack-600-million-in-crypto-stolen-andreturned-in-24-hours https://www.theverge.com/2021/8/23/22638087/poly-network-600-million-stolen-cryptohack-restored-defi

7