Hedera Hashgraph Hit by Smart Contract Exploit: Liquidity Pool Tokens Stolen from DEXs

In a concerning turn of events for the Hedera Hashgraph ecosystem, a smart contract vulnerability has been exploited on the Hedera Mainnet, resulting in the theft of liquidity pool tokens. Hedera, the team behind the distributed ledger, officially acknowledged the incident, confirming that attackers targeted decentralized exchanges (DEXs) that had migrated their code from Ethereum’s Uniswap v2 to the Hedera Token Service (HTS).

What Exactly Happened on the Hedera Mainnet?

According to Hedera’s statements, the exploit occurred through the Smart Contract Service code on the mainnet. Attackers managed to siphon off Hedera Token Service tokens from user accounts and transfer them to addresses under their control. This attack specifically targeted tokens locked in liquidity pools on various Hedera-based DEXs.

Here’s a breakdown of the key events:

• Exploit of Smart Contract Vulnerability: Attackers leveraged a weakness in the Smart Contract Service code on the Hedera Mainnet.
• Targeting Liquidity Pools: The exploit focused on stealing liquidity pool tokens from Decentralized Exchanges (DEXs).
• Token Theft: Hedera Token Service (HTS) tokens were stolen from user accounts and moved to attacker-controlled accounts.
• DEXs Affected: DEXs like SaucerSwap, Pangolin, and HeliSwap, which operate on Hedera, were impacted as their liquidity pools were targeted.
• Hashport Bridge Intervention: When the attackers attempted to move the stolen tokens via the Hashport bridge, Hedera’s team detected the suspicious activity. Operators swiftly halted the bridge to prevent further token movement.

While Hedera hasn’t yet disclosed the precise quantity of tokens stolen, the incident has undoubtedly caused ripples across the Hedera and wider crypto community.

The Root Cause: Decompiling Ethereum Contract Bytecode?

A crucial detail in this situation is Hedera’s recent upgrade on February 3rd. This upgrade was designed to enable the Hedera Token Service (HTS) to support smart contract code compatible with the Ethereum Virtual Machine (EVM). This was a significant step towards enhancing interoperability and attracting Ethereum-based projects to Hedera.

SaucerSwap, a prominent DEX on Hedera, suggests that the vulnerability might stem from the process of decompiling Ethereum contract bytecode to make it compatible with HTS. Decompiling, in essence, is the reverse engineering of compiled code to get back to a more human-readable format. This process can sometimes introduce vulnerabilities if not handled with extreme care.

Although Hedera has not explicitly confirmed decompilation as the root cause in their official statements, SaucerSwap’s insight points towards a potential area of concern. It highlights the complexities involved in bridging technologies from different blockchain ecosystems and the potential security risks that can arise during such transitions.

Hedera’s Swift Response: Disabling Proxies and Working on a Fix

Hedera’s team reacted quickly upon discovering the exploit. Here’s a timeline of their response:

* **March 9th (Initial Action):** Hedera initially disabled network access by shutting down IP proxies. This action was aimed at containing the exploit and preventing further unauthorized access.
* **Identification of Root Cause:** The team stated they had identified the “root cause” of the vulnerability and were actively working on a solution.
* **Mainnet Proxies Disabled:** To further secure the network and prevent additional token theft, Hedera disabled mainnet proxies. This action effectively restricted user access to the mainnet temporarily.
* **Fix in Progress:** Hedera confirmed they are developing a fix to address the identified vulnerability.
* **Hedera Council Authorization:** Once the fix is ready, members of the Hedera Council will authorize the deployment of new code onto the mainnet. This multi-signature approach adds a layer of security and governance to network updates.
* **Proxy Re-enablement:** After the fix is deployed and verified, mainnet proxies will be reactivated, restoring normal network operations.

This rapid response underscores the seriousness with which Hedera is treating the situation and their commitment to securing the network.

Impact on Token Holders and the Market

Hedera advised token holders to take a precautionary step and check their balances on hashscan.io. Users can verify their balances using both their account ID and Ethereum Virtual Machine (EVM) address for added assurance.

The incident has also had a noticeable impact on the price of Hedera’s native token, HBAR. Since news of the exploit broke approximately 16 hours ago, HBAR’s value has decreased by around 7%. This decline mirrors the broader market’s downward trend over the past 24 hours, but the exploit likely contributed to additional selling pressure on HBAR.

Moving Forward: Lessons Learned and Security in Cross-Chain Compatibility

This incident serves as a stark reminder of the ever-present security challenges in the rapidly evolving world of decentralized finance (DeFi) and cross-chain interoperability. While Hedera’s proactive response in containing the exploit is commendable, it underscores the critical importance of rigorous security audits and testing, especially when implementing complex features like EVM compatibility on new platforms.

For users in the Hedera ecosystem, and the broader crypto space, this event highlights the need for:

• Vigilance: Regularly monitor your account balances and transaction history for any suspicious activity.
• Security Awareness: Understand the risks associated with DeFi platforms and liquidity pools.
• Platform Diligence: Stay informed about the security measures and incident response protocols of the platforms you use.

As Hedera works towards implementing a permanent fix and restoring full network functionality, the crypto community will be closely watching. The incident will undoubtedly contribute to ongoing discussions about smart contract security, cross-chain vulnerabilities, and the measures needed to build a more resilient and secure decentralized future.