The Quantstamp Blog

June Security Beat: Keys Over Code

$75.32M was lost across 32 crypto incidents in June, up from May's $59.52M. No coordinated campaign carried the month, but one targeted operation did. A targeted social-engineering attack against Humanity Protocol reached the keys behind the $H token and drained $32M, roughly 42% of every dollar lost in June. Quantstamp led the independent investigation and traced the tooling to a phishing campaign previously seen targeting macOS users. Offchain, a fresh npm supply chain wave hit Red Hat's packages on the first day of the month, and a PeopleSoft zero-day was exploited for two weeks before Oracle said a word. Here's the month in security 👇

Quantstamp Announcements

How the dForce hacker used reentrancy to steal 25 million

The hacker exploited a reentrancy vulnerability in order to manipulate Lendf.Me’s internal record of the hacker's collateral. After the hacker created this false collateral record, the hacker withdrew nearly all assets from the platform.

Quantstamp Announcements

Quantstamp Joins DID Alliance

Quantstamp is proud to announce that it is joining the DID Alliance, an open industry association focused on the development and maintenance of new industry standards for interoperable decentralized identity. With Korean and Silicon Valley companies as founding members, DID Alliance aims to develop and distribute decentralized ID technology that benefits companies globally.

Quantstamp Announcements

Quantstamp Secures and Protects DAI Backstop Syndicate

DeFi community rallies to fill a shortfall forming the DAI Backstop Syndicate, protecting the DAI. Quantstamp provides smart contract coverage warranty via Chainproof while helping to secure the software with support from Maker.

Quantstamp Announcements

Quantstamp Joins the #CryptoAgainstCOVID Alliance

Quantstamp is proud to announce that we are contributing to the Binance Charity Project, Crypto Against COVID. Donations made through this global campaign will be used to purchase medical equipment and supplies that will be distributed throughout countries that are currently most heavily impacted by the virus.

Quantstamp Announcements

Quantstamp Joins MyID Alliance

Quantstamp is proud to join the MyID Alliance, a Digital ID initiative by ICONLOOP. As the world moves towards more online and less face-to-face interactions, Digital ID will be a key enabling technology.

Quantstamp Announcements

Market Dynamics of the 1st bZx Hack: Flash Loans and the Insolvent Loan

In this series, we describe the market dynamics of the 1st bZx attack so we can avoid attacks with market manipulation components in the future.

Quantstamp Labs

Top 3 DeFi Trends

This post discusses how flash loans, zaps, and DeFi aggregators are leveraging composability in order to simplify the user experience and ultimately make DeFi markets hyper-efficient.

Quantstamp Announcements

Bringing Bitcoin to DeFi

DeFi is blockchain’s first killer app, with assets locked up approaching $1 billion USD. But one major asset is missing: Bitcoin. Bitcoin is not only the first crypto asset, but the largest - with over $168 billion USD of Bitcoin in circulation it has deep pools of liquidity. It is one of the least volatile cryptocurrencies and has a large network of fiat on and off ramps. All these properties make it a great crypto-collateral. We think Bitcoin has the potential to transform the DeFi landscape as the most widespread and liquid asset available today.

Quantstamp Announcements

DeFi’s Double-Edged Sword

Composability allows for DeFi projects to leverage one another to create powerful new functionality. However this composability also introduces more risk. These issues have existed for a while, but have been made easier to exploit through the introduction of flash loans. While flash loans themselves do not introduce new vulnerabilities, they level the playing field for attacks which previously required large amounts of capital.