Polkadot's Treasury Faces $1.38 Million Loss Due to Exploited Security Flaw Left Unresolved for Months

Polkadot Treasury Security Breach

In a recent security breach, Polkadot’s Treasury faced a significant setback, incurring losses estimated at $1.38 million due to a vulnerability that had previously been addressed by developers, but not implemented in the production environment in time. The incident, reported by Parity Technologies on November 2, highlights a critical lapse in security around dotUSD, Polkadot’s decentralized stablecoin, which was launched only weeks before, during a period when its governance was fully in the hands of the network's decentralized autonomous organization (DAO).

Vulnerability and Exploit Timeline

The flaw was originally identified back in June but was left unpatched in the live systems ahead of the exploit that occurred from October 24 to October 26. While dotUSD was designed to function without a central issuer—drawing its governance from DOT token holders through an OpenGov framework—the developers initially assessed the threat level of the vulnerability as medium. This classification did not account for its implications upon the stablecoin's operational environment, prompting a re-evaluation to critical status only after the exploit was exploited.

On October 20, before the attack, a security researcher who had initially flagged the issue raised it publicly in a forum, hinting at a remedy. However, after learning that his comments violated bug bounty protocols, the researcher withdrew his remarks. Parity believes this exposure may have inadvertently provided attackers with the crucial information needed to exploit the vulnerability.

Details of the Exploit

The exploit itself allowed the attacker to manipulate Polkadot Asset Hub’s cross-chain messaging, artificially decreasing the supply of dotUSD without actually removing tokens from user accounts. This misrepresentation distorted the pricing in the DOT/dotUSD liquidity pool, enabling traders to exchange dotUSD for DOT at inflated rates, which led to the financial losses for the Treasury, the only liquidity provider in this pool. Yet, Parity confirmed that individual user accounts were unaffected and that dotUSD remained fully collateralized by USDT.

Though it remains unclear if the attacker profited from the arbitrage opportunities presented by the exploit, the situation escalated further when the threat actor managed to bypass an emergency stop implemented by Snowfork to curb the exploitation.

Response and Recovery

Detection of suspicious activity led to Snowfork halting its consensus relayers to prevent additional malicious transactions, but on October 26, just hours before a security update was rolled out via OpenGov, the attacker exploited another independent relayer to resume their malicious actions. The unique nature of the Snowbridge network architecture, which permits independent participants to run relayers, allowed the attacker to continue unfettered by the Snowfork intervention.

Ultimately, Parity was able to deploy runtime upgrade 2.5.1 on October 26 to seal off the vulnerability and recover remaining liquidity from the affected trading pool. A subsequent upgrade on October 30 addressed discrepancies in dotUSD’s recorded supply while ensuring individual account balances remained unchanged.

Lessons Learned

Although the Treasury has reclaimed some of the lost assets, the incident has highlighted flaws in Parity’s security protocols, prompting the firm to enhance its vulnerability assessments, refine deployment procedures, and bolster monitoring for unusual asset activity. Additionally, there are plans to develop an automated AI-driven security framework to catch potential vulnerabilities in coding earlier in the development lifecycle, while also reviewing existing vulnerabilities through the lens of risks posed by dotUSD.

This incident serves as a crucial reminder of the complexities and new security challenges in decentralized finance (DeFi), particularly as networks evolve and introduce innovative financial products.