Decentralized exchange (DEX) KiloEx is taking steps to compensate users affected by a recent $7.5 million hack that temporarily halted platform operations. The exploit, which occurred earlier in April, targeted a price oracle vulnerability. This comprehensive guide breaks down the compensation plan, the nature of the exploit, and KiloEx’s response.
Compensation Plan for Affected Users
KiloEx has outlined a detailed compensation plan to address the losses incurred by traders and stakers. The plan prioritizes fairness and aims to restore user confidence in the platform.
- Traders with Open Positions: Traders who had open positions when the platform was suspended will receive full compensation for any losses incurred due to increased losses or decreased profits during the downtime. The platform will cover the difference.
- Immediate Action Advised: KiloEx strongly urges traders to close their positions immediately upon the platform’s resumption. Delays in closing positions may impact the compensation amount, as calculations are based on the platform’s resume time.
- Stakers’ Funds Secured: For Hybrid Vault stakers, KiloEx has confirmed that the stolen funds were fully restored to the vault. As a result, stakers’ principal and earnings remain unaffected.
- Bonus APY for Stakers: In addition to securing stakers’ principal, KiloEx will provide an additional 10% annual percentage yield (APY) as a bonus for eligible stakers who had funds in the vault before the platform’s suspension.
Understanding the $7.5 Million Exploit
The root cause of the $7.5 million hack lies in a price oracle vulnerability. According to security firm PeckShield, the attacker exploited this vulnerability to manipulate prices, ultimately generating illegitimate profits.
Here’s a breakdown of how the exploit occurred:
- Permissionless Function Exploitation: The attacker leveraged a permissionless function within the KiloEx protocol.
- Artificially Low Price: The attacker crafted a request that, under normal circumstances, should have been restricted to authorized entities. This allowed them to open a position at an artificially low price.
- Illegitimate Profit: Subsequently, the attacker closed the position at a higher price, capitalizing on the manipulated price discrepancy to realize substantial profits.
KiloEx’s Response and Security Measures
Following the exploit, KiloEx took immediate action to contain the damage and recover the stolen funds. Their response included:
- Platform Suspension: KiloEx suspended its platform on April 14 to prevent further exploitation of the vulnerability.
- Bounty Offer: Initially, KiloEx offered a 10% bounty (approximately $750,000) to the hacker in exchange for the return of 90% of the stolen funds. They also threatened legal action if the funds were not returned.
- Funds Returned: Security platforms flagged transactions indicating that the hacker had returned the stolen funds.
- Legal Action Withdrawn: KiloEx subsequently withdrew all legal action against the hacker and honored the 10% white hat bounty.
The Importance of Price Oracles in DeFi
Price oracles are critical components of DeFi platforms. They provide real-world price data that smart contracts use to execute trades, liquidations, and other functions. However, they also represent a potential point of vulnerability. If a price oracle is compromised, it can be exploited to manipulate markets and steal funds, as demonstrated in the KiloEx hack.
Lessons Learned and Future Security Enhancements
The KiloEx exploit underscores the importance of robust security measures and rigorous testing in the DeFi space. Key takeaways include:
- Enhanced Security Audits: Regular and comprehensive security audits are essential to identify potential vulnerabilities in smart contracts and platform infrastructure.
- Price Oracle Security: Implementing robust mechanisms to protect price oracles from manipulation is crucial. This may include using multiple data sources, implementing outlier detection algorithms, and employing decentralized oracle networks.
- Incident Response Planning: DeFi platforms should have well-defined incident response plans in place to quickly address security breaches and minimize potential losses.
- Transparency and Communication: Open and transparent communication with users is vital during and after a security incident. Keeping users informed about the situation, the steps being taken to address it, and the compensation plan builds trust and mitigates reputational damage.
The KiloEx incident serves as a valuable learning experience for the entire DeFi community. By understanding the vulnerabilities that were exploited and implementing enhanced security measures, the industry can work to prevent similar incidents in the future.
