Get Smart – Ending Crypto’s Over-Reliance on Contract Audits

HodlX Guest Post  Submit Your Post

Last year was a rollercoaster for crypto. There were aggressive regulatory actions, high-profile criminal convictions and shocking thefts.

And yet – the total cryptocurrency market capitalization rose to over $1.4 trillion in 2023, a year-over-year growth of over 70.7%.

New users and institutions are getting involved.

Throughout 2023, the number of crypto investors grew by 2.8% per month, and Goldman Sachs has called it the year crypto became institutionalized.

The bulls and the bears are both right – there is immense opportunity in the market right now, but also alarming risk.

The risk isn’t merely rooted in market volatility, though, or even the brazen criminal actions of exchange managers – it’s baked into the very mechanisms of crypto transactions.

Smart contacts themselves are a vulnerable and alluring target for hackers, and our methods for securing them are letting us down.

Here’s a quick primer. A smart contract is a self-executing contract used in blockchain transactions. The terms of the transaction are written directly into the lines of the code.

These contracts are a juicy hacking target – they’re used to handle large sums and high-value tokens.

If you can manipulate the contract, you can direct the tokens however you want.

Blockchain entities protect themselves with smart contract audits, wherein independent reviewers inspect the smart contract for design flaws, security vulnerabilities, efficiency and other coding issues.

The auditors issue a public report, listing all the issues found and the steps taken to mitigate them.

So far, so transparent – audits help blockchain companies ensure their smart contracts are secure and help investors make informed decisions.

The process is far from foolproof, though. There are no widely adopted standards for smart contract verification, and no audit can truly guarantee that a smart contract is bug-free.

As a result, lots of vulnerabilities slip through the cracks, often with devastating results.

Here are a few examples from 2023 alone.

LendHub – $6 million exploit – January 2023

LendHub left a depreciated version of the IBSV token in its smart contract during an update. Both the old and new versions were active in the contract at the same price.

Attackers were able to buy the old version and swap for the new, making off with $6 million in additional value.

BonqDAO – $120 million exploit – February 2023

Attackers were able to…