Security breach results in $6.7 million loss, crypto platform reports

Stock Photo – images.unsplash.com

Raft, a decentralized U.S. dollar crypto platform protocol, has reported a security breach that resulted in a $6.7 million loss last week.

As per Raft’s report on November 13, a hacker had borrowed 6,000 Coinbase-wrapped staked Ether (cbETH) through the DeFi protocol Aave. The hacker then moved this amount to Raft to exploit a smart contract glitch to create an additional $6.7 million in R tokens, Raft’s stablecoin.

The illegally created funds were traded off the platform using liquidity pools on decentralized exchanges like Balancer and Uniswap, resulting in $3.6 million in profits. As a consequence of the attack, the R stablecoin depreciated.

“The primary root cause was a precision calculation issue when minting share tokens, which enabled the exploiter to obtain extra share tokens. The attacker leveraged the amplified index value to increase the worth of their shares,” the report said.

The smart contracts involved in the incident had undergone audits by blockchain security firms Trail of Bits and Hats Finance. “Unfortunately, the vulnerabilities that led to the incident were not detected in these audits,” Raft said.

Since the November 10 incident, Raft has filed a police report and is collaborating with centralized exchanges to trace the stolen funds. All of Raft’s smart contracts are suspended. However, users who have minted R tokens “retain the ability to repay their positions and retrieve their collateral.”

Decentralized stablecoins use users’ crypto deposits as collateral. In December 2022, the decentralized stablecoin HAY lost its peg with the U.S. dollar after a hacker exploited a smart contract glitch, minting 16 million HAY without sufficient collateral. The HAY stablecoin has since regained its peg.

Blockchain Association alerts threat to DeFi from tax rule change

The U.S. Treasury and the Internal Revenue Service (IRS) are discussing a potential change to a single word in a tax rule. The Blockchain Association revealed Monday that such an alteration could result in permanent harm or prompt DeFi projects to relocate outside the U.S.

The Blockchain Association has submitted a 33-page comment advocating against the proposed change. It explains why altering the tax collector’s definition of the word “broker,” as proposed in late August, could severely impact the DeFi industry.

The proposed change aims to extend the definition of “broker” to encompass all U.S.-based centralized crypto exchanges and any crypto project that enables the transfer of digital assets owned by someone else, including DeFi protocols.

Consequently, American centralized exchanges and DeFi projects would fall under the same reporting regulations as traditional bond and stock brokers.

The Blockchain Association said that applying this standard to DeFi projects is unrealistic.

“It will drive U.S.-based decentralized projects abroad or out of existence, full stop,” Marisa Tashman Coppel, senior counsel at the Blockchain Association, wrote on social media.

The Blockchain Association argues that the aim of DeFi is to establish trustless financial systems. This is achieved by using smart contracts and automation to prevent a project’s creator from controlling or accessing users’ finances and information.

“Any attempt to link wallet addresses to personal identities would create a serious and permanent privacy issue for those users. Comparable to having a lifetime of credit card transactions published online, this would mean exposing each user’s entire transaction history to the world,” the Blockchain Association said.

” It does not take much imagination to understand that this is an unacceptable outcome.”

The change has been open for a 74-day public comment period. It has received over 124,000 public comments.