DeFi farming project Pickle Finance is the latest DeFi project to be hit hard by those who may share the same entrepreneurial spirit, if not the same methods.
Unlike the recent flashloan fiasco Value DeFi recently went through, the attack on Pickle Finance was a bona fide malicious attack, with none of the tongue-in-cheek humor.
Value DeFi has since switched to Chainlink, arguing that their system provides better protection from exploits.
Evil Jar Swap
Pickle Finance’s modus operandi was based on providing automatic solutions for transactions between various DeFi protocols.
However, in order to maximize profits Pickle Finance required users to deposit funds in compound for trading purposes.
This allowed the unknown bad actor to swap the funds between Pickle Finance’s cDAI jar and a copycat contract. The copycat contract had a similar interface to the legitimate one but was programmed to execute itself differently, allowing the bad actor to make a huge profit.
Confirmed 30 seconds later, the person behind the attack sent $20 million worth of funds from Pickle’s cDAI jar to his own “evil jar”.
However, the DeFi company’s problems are not over, as their value has since plummeted by 58% within just a few hours – as proven by their current trending search on CoinGecko. The price has since slightly rebounded, making the loss of value closer to 52%.
Twitter users have been making light of the issue – with a user quipping that the new security audit will be to have proper insurance coverage, and others replying that they should start a security audit company for security audit companies.
Nevertheless, the past few weeks have seen several more DeFi projects, such as Akropolis, Harvest Finance, and Cheese Bank fall victim to bad actors.
There is a silver lining to all the trouble, however: new and existing DeFi companies will now probably start beefing up their security, spurring decentralized finance down the path to becoming a huge competitor for traditional finance.