profile-img
Radix - Radically Different DeFi

@radixdlt

The Full Stack for DeFi.

Discord: https://t.co/K2bV4gNFl8
Telegram: https://t.co/U43tKZvCyx
Radix Wallet: https://t.co/AuxqtbeVUa

Posts on behalf of Radix Publishing Limited.

calendar_today26-12-2013 19:55:41

5,8K Tweets

205,7K Followers

159 Following

Radix - Radically Different DeFi(@radixdlt) 's Twitter Profile Photo

TLDR: COSMWASM developers must implement validations to prevent funds being withdrawn multiple times. On , as tokens and badges provide native ways to account for user positions and authorize actions, a Radix dApp would never be designed with this vulnerability.
(3/13)

account_circle
Radix - Radically Different DeFi(@radixdlt) 's Twitter Profile Photo

Mirror Protocol was a dApp on Terra (now Terra Classic) that allowed users to deposit collateral, such as UST, and mint “mAssets”, which are synthetic tokens that mirror the price of another asset such as ETH (the mirrored version would be mETH).
(4/13)

account_circle
Radix - Radically Different DeFi(@radixdlt) 's Twitter Profile Photo

Other users are able to open long or short positions against those mAssets by depositing collateral and buying or selling short those mAssets. Depending on how the price of the mAsset changes, those users can then close those positions for profit or loss, or get liquidated
(5/13)

account_circle
Radix - Radically Different DeFi(@radixdlt) 's Twitter Profile Photo

To close a position, a user submits a tx to the Mirror contract. Their account is linked to a Position ID with metadata recording the user’s collateral, leverage, and position. As this position is in profit, when closed, the user is credited the collateral and position.
(6/13)

To close a position, a user submits a tx to the Mirror contract. Their account is linked to a Position ID with metadata recording the user’s collateral, leverage, and position. As this position is in profit, when closed, the user is credited the collateral and position. (6/13)
account_circle
Radix - Radically Different DeFi(@radixdlt) 's Twitter Profile Photo

On Sep 11 2021, a hacker was able to trick the Mirror contract into closing an inflated position multiple times as the contract did not check for duplicate withdrawals. For one transaction, the hacker used the same position (43186) to withdraw ~100k UST 437 times.
(7/13)

account_circle
Radix - Radically Different DeFi(@radixdlt) 's Twitter Profile Photo

So why couldn’t this hack happen on Radix’s upcoming Babylon mainnet?

(1) To authorize the closure of a position, the user would have to present a “badge” (a resource like an NFT) that is associated with their position. Once the position is closed, the badge is burnt.
(8/13)

So why couldn’t this hack happen on Radix’s upcoming Babylon mainnet? (1) To authorize the closure of a position, the user would have to present a “badge” (a resource like an NFT) that is associated with their position. Once the position is closed, the badge is burnt. (8/13)
account_circle
Radix - Radically Different DeFi(@radixdlt) 's Twitter Profile Photo

(2) Tokens on Radix live in vaults inside components (smart contracts). For “Mirror” on Radix, each position would have its own vault. This means that once the position is closed, the vault for that position is empty!
(9/13)

(2) Tokens on Radix live in vaults inside components (smart contracts). For “Mirror” on Radix, each position would have its own vault. This means that once the position is closed, the vault for that position is empty! (9/13)
account_circle
Radix - Radically Different DeFi(@radixdlt) 's Twitter Profile Photo

This means there’s no more pooling of user funds into “omnibus” accounts, where if there’s an error in accounting, the entire pool - and everyone’s tokens - can be drained. Instead, individual vaults for each position make Radix dApps far more safe and intuitive to build.
(10/13)

account_circle
Radix - Radically Different DeFi(@radixdlt) 's Twitter Profile Photo

The hack fails immediately as the badge for the position is burnt after the first withdrawal, and the vault is then empty!

As the tokens live in a specific vault for each position, there is no scope for the developer to miss a “duplicate withdrawal” check.
(11/13)

The hack fails immediately as the badge for the position is burnt after the first withdrawal, and the vault is then empty! As the tokens live in a specific vault for each position, there is no scope for the developer to miss a “duplicate withdrawal” check. (11/13)
account_circle
Radix - Radically Different DeFi(@radixdlt) 's Twitter Profile Photo

If you’d like to learn more about how is a game-changer for , I recommend you read this article on

radixdlt.com/post/radix-eng…

(12/13)

account_circle
Radix - Radically Different DeFi(@radixdlt) 's Twitter Profile Photo

For the last in the Rekt Retweet series:

Rekt Retweet #7: Why Blueprints and Components would have prevented the $11m Value hack on $BSC

twitter.com/radixdlt/statu…

(13/13)

account_circle