Source: Kalibroida(dot)com

ARTICLE OUTLINE

👉 Introduction

👉 What are smart contracts?

👉 Hacks and exploits of smart contracts

👉 Consequences of smart contract hacks

👉 Conclusion

INTRODUCTION

When I got onboarded into the web3 space, there’s one thing I learnt and it’s that “smart contracts are encrypted and can hardly be hacked.” That explanation stuck with me. However, with what I see now I guess the impenetrability of smart contracts was a bit exaggerated. Despite expensive audits, most smart contracts have been revealed to be vulnerable to attacks.

A smart contract audit is a deep evaluation, inspection, and analysis of a smart contract code to identify security issues, code errors, and potential vulnerabilities. Blockchain projects usually carry out smart contract audits before launching. There are blockchain security companies specialized in smart contract auditing and it’s usually a long and expensive process. However, despite all of these measures taken, there are countless reports of smart contract exploitation leading to the loss of millions of dollars. Let’s take a look at what I mean.

WHAT ARE SMART CONTRACTS?

Smart contracts are programs that eliminate the reliance on intermediaries or the need to trust one another by automatically executing agreements immediately after the conditions or logic the programs were built on have been met. Simply put, they are a self-executing set of programs that run on blockchains.

Source: iPleaders

A smart contract ensures that the logic it was originally written on will be carried out precisely as intended. Furthermore, once the predefined logic has been carried out, the network's ultimate state will remain immutable (unchangeable). This, unfortunately, isn’t enough to keep it 100% secure. The complexity of smart contracts has made them vulnerable to hacks and the monetary valuation of the web3 industry has made it a target for hackers and scammers.

HACKS & EXPLOITS OF SMART CONTRACTS

Since Ethereum implemented the use of smart contracts in blockchain technology in 2013, it has gained widespread use in various blockchains. The hacks that chase smart contracts are almost inevitable. In 2018, a group of five researchers carried out a study and showed that one out of twenty-one smart contracts was at risk of being hacked.

Smart contract hacks and exploits that have happened over the years:

~ The first DAO launched on the Ethereum Network in 2016 which was supposed to be a venture capital firm was hacked just three months after the launch, leading to a loss of $60 million in various cryptocurrencies belonging to the DAO members. The DAO’s smart contract was reportedly flawed.

~ In 2017, Parity Wallet was hacked and $34 million was stolen.

~ In 2021, Poly Network, a cross-chain DeFi protocol was hacked for $611 million. This led to a negotiation between the network executives and the hacker(s). The hacker(s) eventually returned all the assets and said he/she/they did it for fun just to show the vulnerabilities of its contracts. In an interesting turn of events, the hacker(s) was offered a job by Poly Network to be their Chief Security Advisor but he/she/they turned it down and chose to remain anonymous.

~ Another smart contract hack took place in 2021 which led to funds of over $30 million being lost to the hackers. The victim company was Meerkat Finance, a yield-farming protocol

~ In 2022, the Ronin Bridge hack made headlines as one of the biggest crypto hacks. The smart contract hack led to a loss of 173,000 ETH and 25 million USDC which amounted to over $600 million (at the time of the attack).

~ Over $80 million in customers’ funds was lost from Qubit Finance, a popular DeFi platform. This occurred as a result of a logical fault in the smart contract design.

~ Last month, another smart contract hack (reentrancy attack) happened on the popular multi-chain DEX aggregator, KyberSwap. Approximately $46 million was lost as a result of the hack on several networks (Ethereum, Arbitrum, Polygon, Optimism, Avalanche, Polygon, Base, and Kyber Mainnet). There was a series of communications between the KyberSwap team and the hacker, where the hacker kept threatening the KyberSwap team and demanding things. You can catch up on the full story here.

Below is an image of one of the messages the hacker sent.

~ The recent one happened just two days ago. $370K was lost in OKX Dex’s smart contract compromise. They have promised to reimburse affected users.

Believe me when I say these highlighted instances are not even close to how many smart contract hacks have happened over the years. A blockchain security company, PeckSheild confirmed that $480 million was lost in smart contract DeFi hacks in just the first half of 2023.

Affected companies offer bounties either to the hackers or to anyone who can help them regain the stolen funds. Some blockchain companies, in a bid to prevent the occurrence of hacks, put up bug bounty contests to get ethical hackers to report any vulnerability or bugs they discover in their codes. Those who successfully find vulnerabilities are rewarded. This is done to improve their security.

CONSEQUENCES OF SMART CONTRACT HACKS

Smart contract hacks have obvious negative effects on the firms and users affected, some of which are listed below.

~ Loss of funds

~ Shut down: depending on the amount of funds lost and the size of the company, some platforms suffer majorly from hacks like this and as a result, close down due to the inability to continue operations.

~ Loss of credibility and trust: companies that suffer huge hacks like this sometimes lose credibility in the eyes of their users.

~ Rare consequences like the hacker(s) demanding control of the company, like in the case of KyberSwap, in exchange for the return of the stolen funds.

CONCLUSION

Hacks and exploits are slowly becoming part and parcel of the blockchain industry, despite measures that are taken to prevent their occurrences.

What else do you think can be done to eliminate this?

To prevent this piece from getting too lengthy, I didn’t get into details of how some of these hacks occur. Maybe that’ll be another article. For now, leave your thoughts in the comment section below.