Atlantis Loans Hack, June 10, 2023: Detailed Hack Analysis

Overview

On June 10, 2023, the Atlantis Loans platform fell victim to a smart contract hack, exploiting a governance vulnerability. The hack resulted in a substantial financial loss of approximately $1M USD.

Hack Details:

Attacker address:
https://bscscan.com/address/0xEADe071FF23bceF312deC938eCE29f7da62CF45b

Attack Transaction:
https://bscscan.com/tx/0x3b0df86f548946d9dda9fb4177ae27bf33f06315c73ea50945ab9e53a041d7e1

Malicious contract:
https://bscscan.com/address/0x613cc544053812ab026d60361212cdb67b46f42f

Chronological Events and Mechanism of the Attack

Status Before June 7

Atlantis Loans was abandoned by its developers in early April. This absence resulted in a lowered guard against potential threats.

The platform’s UI was paid up for two years, and only governance mechanisms could implement changes.

An attack attempted on April 12 failed due to insufficient votes.

The attacker published and then voted through proposal 52, targeting the GovernorBravo contract. This proposal was designed to give them administrative control over the token’s proxy contract.

GovernorBravo, by design, only verified the eta parameter (unlock time) during the proposal queue, a flaw that was exploited.

June 10 (Main Attack Launched)

Hack Txn: https://bscscan.com/tx/0x3b0df86f548946d9dda9fb4177ae27bf33f06315c73ea50945ab9e53a041d7e1

Post 172,800 seconds (2 days) of lockup:

• The attacker successfully navigated the waiting period.
• They subsequently altered the existing contract logic, embedding a backdoor within their malicious contract: 0x613cc544053812ab026d60361212cdb67b46f42f.

Funds Stolen

Using the backdoor, the attacker siphoned tokens from addresses with active smart contract approvals tied to Atlantis contracts, directing these to their own wallet. This was enabled largely by the “approvals” users had granted.

Vulnerabilities and Root Cause Analysis

• Governance Oversight:
  A primary flaw lies in Atlantis Loans’ governance structure. Exploiting the GovernorBravo contract, which only focused on the eta parameter was pivotal.
• Smart Contract Approvals:
  By granting permissions, users inadvertently jeopardized their own assets. Such approvals meant tokens could be accessed and redirected in an unauthorized manner.
• Abandoned Project Oversight:
  The lack of active oversight and monitoring due to the project’s abandonment provided an opportunity for the attacker. The passage of proposal 52 without contention is reflective of this void.
• Historical Precedents:
  Platforms like Beanstalk and Swerve had faced similar threats. These incidents should’ve served as a cautionary tale about vulnerabilities inherent in smart contract governance, especially with decreased monitoring.

Contracts at Risk

Following is the list of contracts that were potential targets in this hack, and users were advised to revoke permissions for these contracts:

Historical Context

• Beanstalk suffered a flash loan-enabled governance attack in the previous year, leading to a loss of $181M.
• Swerve, a Curve-clone, faced an unsuccessful attack via governance in March. This attack would have transferred $1.3M from a liquidity pool had it succeeded.

Mitigation and Best Practices

1. Access Control: Be vigilant when assigning administrative privileges within contracts. Implement robust access control mechanisms.
2. Multi-signature Schemes: These require multiple entities to approve significant actions, reducing the potential for a single point of compromise.
3. Regular Audits: Ensure smart contracts are frequently audited by professionals to check for logical vulnerabilities.
4. Revoke Old Approvals: Users should be proactive in revoking permissions to old or unused contracts to prevent unauthorized access.
5. Monitoring Governance: Even if projects are discontinued, governance processes should be monitored to prevent malicious activities.

Conclusion

The Atlantis Loans hack sheds light on the intricate vulnerabilities present within smart contracts, especially those associated with governance.

While the technology behind smart contracts offers a plethora of benefits, it is paramount to continually evaluate, update, and monitor these contracts to ensure the security of users and the platform.