Fantom's Podcast: How Big is the Vulnerability? Can you save yourself?

Affected by the Multichain incident, Fantom is also in danger.

Since Fantom adopted Multichain as the main cross-chain bridge of the ecology, as the Multichain funds experienced a loophole (126 million US dollars flowed out on July 7, of which about 118 million US dollars were transferred from the Multichain Fantom bridge contract), this loophole brought The influence of is also directly transmitted to Fantom.

The most intuitive manifestation is that the stable currency issued by the Multichain bridge contract on Fantom has experienced a significant unanchoring. According to the SpookySwap market, as of the publication, USDC-MULTI, fUSDT-MULTI, and DAI-MULTI (Multichain bridge stablecoin) are all quoted at around US$0.27.

Although Fantom has frozen 62 million USDC, USDT and other funds by contacting Circle, Tether and other stablecoin issuers, **Since nearly half of the funds in the 118 million USD hole are pure on-chain assets such as WETH and WBTC that cannot be frozen, It cannot be recovered through similar channels, so the gap of the US$56 million in funds should be difficult to fill in a short time. **

In addition, in view of Multichain’s recent official disclosure that the co-founder Zhaojun’s sister has also lost contact, it was transferred to two EOA wallets for asset preservation purposes on July 9 (0x1eed63efba5f81d95bfe37d82c8e736b974f477b; 0x48bead89e696ee93b04913cb0006f3 5adb844537) about 151 million There are also variables in the follow-up of U.S. dollar funds. Taking a step back, even if it does not lose control of funds, there is a high probability that it will be difficult to deal with the funds in a short period of time, so this part of the funds can be regarded as a gap for the time being.

In short, the current situation is that **Fantom ecology carries a certainty gap of 56 million US dollars due to this event, and a potential gap of 151 million US dollars. **

Lessons from Harmony

Fantom's current situation, we can find some shadows from Harmony a year ago.

In June 2022, Horizon, the official cross-chain bridge of Harmony, was hacked and the loss amounted to about 100 million US dollars. Although Harmony also tried various ways to recover the stolen goods afterwards, but in the end it was fruitless.

Since the stablecoins on the Harmony chain are mainly issued through the Horizon bridge contract, there is also a problem of large unpegging. This is exactly the same as Fantom's current situation. Perhaps it is a little "lucky" that compared to Harmony's own mistakes that need to bear the responsibility for compensation directly, Fantom this time can only be regarded as an indirect party other than Multichain.

But then again, Fantom chose Multichain, a third-party service, as the main cross-chain bridge, which is tantamount to putting ecological security at risk (Zhaojun's personal server), and this choice itself is also debatable.

The unanchoring of stablecoins does not only mean losses on the books of the holders. From an ecological point of view, the failure of its utility will inevitably have an adverse impact on the development of ecological projects.

The more intuitive performance is that the operation of some projects will be forced to suffer a huge impact, especially the lending agreement. Since in such incidents, the unanchoring of stablecoins occurs almost instantaneously, it is difficult for the lending agreement to perform effective liquidation, resulting in huge bad debts. Aave on the Harmony chain has not yet resumed normal operation, and Fantom Geist Finance, the largest lending agreement above, has also announced its permanent shutdown.

The more insidious but more intuitive impact is indeed that the loopholes cannot be resolved for a long time, and it will destroy confidence for all projects in the ecosystem, which is almost the same as slow death. In the past year, we have seen too many projects migrate from Harmony, and a similar situation may happen to Fantom.

Can the bug be fixed? What is the lesson?

Of course, filling the hole is difficult for Fantom, but it is not impossible. Not to mention that the control of the two EOA wallets is still unclear, but in terms of Fantom's own financial situation (see "AC's Personal Account of Fantom's Financial History: From $2 Million to $1.5 Billion"), AC has personally stated that In November 2022, the Fantom treasury held more than 450 million FTMs, $100 million in stable coins, $100 million in encrypted assets, and $50 million in non-encrypted assets.

Judging from the absolute figures alone, the fund reserves of the Fantom treasury are sufficient to cover this vulnerability, but whether the situation will reach the point where Fantom uses the treasury, and what attitude the community will have on this, is temporarily unknown.

Combining this Fantom incident and even the earlier Harmony incident, we can see that "cross-chain dragging down the public chain" is no longer an isolated case, but a certain general risk has emerged. From the perspective of the public chain, if we want to avoid such incidents from happening again, we can only minimize the systemic impact of cross-chain bridges on the overall ecological operation.

Here may be several potential solutions at different levels: First, the public chain incubates its own native stablecoin, which will minimize external risk transmission, but it is also the most difficult; the second is to cooperate with Circle, Tether and other stablecoins Publishers cooperate to issue native USDC and USDT on their own chains. This is the most popular way at present, but it also needs to test the comprehensive development status of the public chain and the strength of business cooperation; third, it may also be possible to minimize the dependence on a single cross-chain bridge , to balance the number of stable coins issued by each bridge contract through regulatory measures such as incentives.

All in all, the cross-chain bridge is the biggest source of ecological risk on the chain (perhaps not one of them), and all levels of components combined with it should maintain sufficient security vigilance. We hope that Fantom can get out of the quagmire smoothly, and we hope that similar incidents will not happen again occur.