Case Study: Dragonberry
In early October of 2022, Binance Smart Chain (or BSC) was attacked for over $100 million dollars. The attack was nuanced - the attacker was able to mint previously non-existent tokens and sell them, rather than steal from user funds. Since BSC is built from a considerable portion of Cosmos software, this attack prompted some investigation by the Osmosis team into possible vulnerabilities.
They discovered that a bug in the core libraries for the Inter-blockchain communication protocol (IBC) allowed for attacks on all Cosmos chains of a similar nature to the one that occurred on BNB. This meant that the integrity of tokens across all Cosmos chains were suddenly in serious jeopardy. We conservatively estimate that over $25 million worth of assets at the time was under threat by this bug across the top 15 IBC-enabled Cosmos chains.
While Notional was not involved in creating the patch for this bug, we were on the frontline of mass coordinating upgrades across all IBC-enabled chains. We fell naturally into this role due to our extensive connections with Cosmos validators and our reputation in the area of security. As you may know, coordinating upgrades (especially urgent ones) is no easy task in Cosmos, and this one had to be handled without too much publicity. Our major accomplishment was in leveraging our connections to get the first ⅓ of voting power across all major chains to upgrade, since this would ensure that the vulnerability would not exist long enough to be exploited.
Getting this first ⅓ was a critical step, as it created a significant moat of safety. As you may recall, if ⅓ of the voting power on a Tendermint chain does not participate in consensus, the chain will halt. This means that even if no other validators managed to upgrade before an attack, user funds would not have been at risk.
Validators are the watchers on the wall for Cosmos chains, and Notional takes this role very seriously. We hope that no further bugs of such critical importance will emerge again, but if they do we will be ready to assist in any way that we can.
They discovered that a bug in the core libraries for the Inter-blockchain communication protocol (IBC) allowed for attacks on all Cosmos chains of a similar nature to the one that occurred on BNB. This meant that the integrity of tokens across all Cosmos chains were suddenly in serious jeopardy. We conservatively estimate that over $25 million worth of assets at the time was under threat by this bug across the top 15 IBC-enabled Cosmos chains.
While Notional was not involved in creating the patch for this bug, we were on the frontline of mass coordinating upgrades across all IBC-enabled chains. We fell naturally into this role due to our extensive connections with Cosmos validators and our reputation in the area of security. As you may know, coordinating upgrades (especially urgent ones) is no easy task in Cosmos, and this one had to be handled without too much publicity. Our major accomplishment was in leveraging our connections to get the first ⅓ of voting power across all major chains to upgrade, since this would ensure that the vulnerability would not exist long enough to be exploited.
Getting this first ⅓ was a critical step, as it created a significant moat of safety. As you may recall, if ⅓ of the voting power on a Tendermint chain does not participate in consensus, the chain will halt. This means that even if no other validators managed to upgrade before an attack, user funds would not have been at risk.
Validators are the watchers on the wall for Cosmos chains, and Notional takes this role very seriously. We hope that no further bugs of such critical importance will emerge again, but if they do we will be ready to assist in any way that we can.
Learn
