DeFi Project Thena on BSC Chain Attacked, $20k Loss Incurred

On March 28th, it was reported that the DeFi project Thena on the BSC chain was attacked, resulting in a loss of approximately $20000, according to the monitoring by the OKLink security team of the Ouke Cloud Chain. According to the security team’s analysis, the main cause of this attack event is that the Strategy contract upgrade introduced some configuration issues, and the unstake function did not perform permission verification, resulting in attackers being able to call the unstake function and pass in parameters_ Beneficiary, unstack the user’s pledged assets to_ Beneficiary address. Taking one of the transactions as an example, the attacker calls the unstake function to set_ Beneficiary is an attack contract that removes user assets and completes the attack.

Thena, the DeFi project on the BSC chain, was attacked, resulting in a loss of approximately $20000

Introduction

On March 28th, the DeFi project Thena on the Binance Smart Chain (BSC) was attacked, resulting in a loss of approximately $20,000. The OKLink security team of the Ouke Cloud Chain reported this loss after monitoring the event. Following an analysis of the attack, the OKLink team concluded that the primary cause was the result of configuration issues in the Strategy contract upgrade, coupled with the unstake function that did not perform permission verification, enabling attackers to call the function and pass parameters to remove users’ pledged assets.

Why is DeFi Security Important?

The DeFi (Decentralized Finance) space is becoming more popular, which necessitates a robust security system to protect users and their assets. The offers in the DeFi space are all for making financial gains, which makes it an attractive target for hackers, and as such, the security systems must remain rigorous.

Overview of DeFi Projects Security

Decentralized finance projects must be conversant with security best practices to detect and tackle any security risks. Some of the security methods utilized are multi-signature (multisig) wallets, smart contract audits, and bug bounties.
The multisig wallet ensures that no single entity can control transactions, thus preventing bad actors from wreaking havoc. Smart contract audits are used to check the security vulnerabilities that might exist in the smart contract code.

The Strategy Contract Upgrade

Thena’s strategy contract contained configuration issues that made it vulnerable to attack. The upgrade was not adequately checked to avoid introducing an attack vector that attackers could abuse to access and remove user assets.

Unstake Function Vulnerability

The Thena protocol’s unstake function did not perform permission verification as expected, which made it vulnerable to attack. The attackers could use the unstake function and pass in parameters to remove users’ pledged assets. This function allowed attackers to call the function and set the beneficiary as an attack contract that could delete user’s assets entirely.

The Attack

The attackers took advantage of the vulnerabilities in the strategy contract upgrade and unstake function to execute their attack. They passed parameters to the unstake function that enabled them to transfer the user’s assets to an attacker-controlled beneficiary address. Through this method, the attackers stole approximately $20,000 from the Thena protocol.

Conclusion

As the DeFi space continues to grow in popularity, security systems must remain robust and enable early detection of vulnerabilities. The DeFi community must enforce security best practices such as smart contract auditing and bug bounties, among others. It is essential to stay vigilant and avoid vulnerabilities that might lead to significant losses.

FAQs

Q1. Is Thena the only DeFi project that has been attacked?

No, Thena is not the only DeFi project that has been attacked. There have been several DeFi attacks, and this makes it crucial to uphold robust security measures.

Q2. What measures can be taken to prevent such attacks in the future?

Measures such as smart contract audits, bug bounties, and regular security maintenance checks can help detect and prevent such attacks. It is also vital to implement security protocols and procedures when developing DeFi projects.

Q3. Is it safe to invest in DeFi projects?

Investing in DeFi projects is a personal choice that one must make by evaluating the risks and benefits carefully. It is essential to conduct thorough research of a DeFi project before investing.