Quick take:<\/p>\n
Convex Finance has patched<\/a> a rug pull vulnerability that could have resulted in the loss of the entire total value locked on the protocol.<\/p>\n The discovery of the bug was made after Coinbase<\/a> tasked OpenZeppelin with conducting a security audit of Convex Finance. The Defi<\/a> protocol is popular amongst the holders of Curve (CRV) who use it to boost yields and rewards.<\/p>\n OpenZeppelin kick-started the audit in late 2021 and resulted in its security team discovering that if the vulnerability was exploited by two of the three anonymous multi-signature wallet signers, it ‘would have given the Convex multisig direct control over Convex\u2019s locked value\u2014then approximately $15 billion’.<\/p>\n The team at OpenZeppelin explained that if ‘two of the three signers of the Convex multisig executed a specific series of steps, those users would be provided with unrestricted access to LP tokens staked in a target pool configured with the LP token and target gauge’. Furthermore, ‘Convex\u2019s documentation at the time…stated that this should not be possible\u2014hence the cautious approach to resolution’.<\/p>\n In terms of remedial action, the patch was implemented on December 14th, 2021.<\/p>\n However, the process was a bit ‘tricky’ as the Convex development team is anonymous. Consequently, OpenZeppelin was not sure that disclosing the bug to the developers, would be the right decision given that they could exploit it themselves.<\/p>\n OpenZeppelin solved this dilemma by reaching out to the bug bounty partner, Immunefi. The latter introduced ‘an intermediary between OpenZeppelin and Convex’.<\/p>\nDisclosure of the Bug was Tricky Given Convex’s Developers are Anonymous<\/h2>\n