Polkadot Treasury loses $1.38 million after attacker exploits old bug

Polkadot loses $1.38 million in October attack

Polkadot's Treasury lost about $1.38 million after an attacker exploited a security flaw in October. Parity Technologies said the flaw had been fixed in June but the fix had not reached the affected live systems.

The attack targeted dotUSD, Polkadot's new stablecoin. A stablecoin is a crypto token designed to keep a steady value. dotUSD launched in October and was governed by Polkadot's community system, called OpenGov, instead of a single private company.

Parity, a firm that builds infrastructure for Polkadot and Kusama, published details in a Nov. 2 incident report.

Key points from the report

• The bug was found and fixed in code in June, but was missing from affected live systems during the Oct. 24 to Oct. 26 attack.
• The attacker used Polkadot's cross-chain messaging system, called XCM, to change dotUSD's recorded supply.
• Prices in the DOT/dotUSD trading pool were distorted, and traders could swap dotUSD for DOT at wrong rates.
• The Treasury was the pool's only liquidity provider and lost about $1.381 million, according to Parity's estimate.
• Parity said no users lost funds and dotUSD stayed fully backed by USDT, another stablecoin.

How the fix missed live systems

Parity said it merged a fix for the XCM bug in June. The fix missed a cutoff for a release called stable-2606. It was not present in the affected live software when the attack happened.

Parity first rated the bug as medium severity. It later raised the rating to critical after the attack showed the possible financial harm. Parity said its first assessment did not consider how the bug could interact with dotUSD, which had not launched yet.

Emergency halt and bypass on Oct. 24 to 26

After suspicious activity on Oct. 24, Snowfork stopped its own consensus relayers. Relayers are off-chain processes that carry messages between networks. This stopped the attack for a short time.

The attacker then ran its own relayer on Oct. 26 and resumed the attack about six hours before a security upgrade took effect. Snowbridge documentation says relayers are permissionless, meaning anyone can run one. A halt by one operator can therefore only delay an attacker who runs another relayer.

Parity closed the bug with runtime upgrade 2.5.1 on Oct. 26 and rescued the remaining liquidity in the pool. A second upgrade, 2.5.2, was enacted on Oct. 30. It corrected dotUSD's recorded supply from existing account balances without changing individual balances.

What is confirmed and what is still unclear

Confirmed facts are the June fix, the missing deployment, the Oct. 24 to 26 attack period, the bypass of Snowfork's halt, the two upgrades, and the estimated Treasury loss.

Some points remain unclear. Parity said a researcher posted a forum comment on Oct. 20 that mentioned the June fix, then removed it after being told it broke bug bounty rules. Parity believes the comment may have helped attackers find the bug, but that link is not proven.

Parity also could not establish whether the attacker profited from the later trading at wrong prices. The identity of who benefited from those trades is unresolved.

Changes Parity plans after the incident

Parity said its security process did not account for risks created by new features such as dotUSD. It will strengthen vulnerability checks and deployment checks.

The company also plans more monitoring for unusual asset issuance. It is refining an automated AI-based security framework to spot risky code changes earlier. It will also recheck past reported vulnerabilities for risks linked to dotUSD.

Sources

• CryptoSlate