Sentient Lost $1 Million Due to Balancer’s Read-Only and Reentrant Nature on Arbitrum Network

On April 5th, according to PeckShield monitoring, Sentient, an unlicensed partial mortgage loan agreement, was stolen about $1 million on the Arbitrum network early this morning. The root cause is the read-only and reentrant nature of Balancer.

Security team: Sentient loan agreement stolen $1 million on the Arbitrum network

On April 5th, PeckShield monitoring reported that Sentient, an unlicensed partial mortgage loan agreement, was stolen about $1 million on the Arbitrum network in the early hours of the morning. The root cause of the theft was the read-only and reentrant nature of Balancer. In this article, we will explore this incident in detail and understand what Balancer is and how its nature contributed to the theft.

What is Balancer?

Balancer is a programmable liquidity platform that allows users to create liquidity pools for trading assets. It can be thought of as a self-balancing index fund for cryptocurrencies. It operates on the Ethereum network and uses smart contracts to execute its functionality. Balancer allows users to create custom pools, set fees for trading, and earn rewards for providing liquidity. It also supports several cryptocurrencies, including ETH, USDT, and USDC.

How does Balancer’s Read-Only and Reentrant Nature Affect Security?

Read-only and reentrant functions are a standard part of smart contract programming. They allow other functions within the same contract to read and/or modify state variables within the contract. However, when not used correctly, they can lead to several security vulnerabilities.
In the case of Balancer, a read-only and reentrant vulnerability in its smart contract allowed the attackers to drain Sentient’s funds. Attackers exploited the vulnerability by using flash loans, a type of uncollateralized loan that is borrowed and repaid within the same transaction, to manipulate the liquidity pools. They were also able to create multiple recursive transactions to confuse the smart contract and continue the attack, draining more funds.

Lessons Learned

The Sentient incident highlights several critical security issues within DeFi protocols. The first lesson is the importance of thorough auditing of smart contracts before deployment. This incident exposed a flaw in Balancer’s code, which could have been identified before the attack, ultimately preventing the theft. Secondly, the vulnerability in Balancer was relatively simple to fix, but it highlights how even small oversights can lead to significant impacts on users’ funds. Lastly, the incident reinforces the need for non-custodial wallet security, such as hardware wallets, and the importance of proper storage and handling of private keys.

Conclusion

Sentient’s theft on the Arbitrum network was a significant incident that highlighted the importance of smart contract auditing, DeFi protocol vulnerability, and wallet security. The read-only and reentrant function’s vulnerability in Balancer was the root cause of this hack, which led to the theft of $1 million in funds. It is essential to understand the implications of these security issues as we continue to integrate DeFi protocols within our financial systems.
—

FAQs

#What steps can be taken to prevent similar attacks in the future?

Proper auditing of smart contracts, implementing fixes for known vulnerabilities, using secure wallet storage and handling techniques, and educating users about security best practices are all critical steps that can prevent similar attacks in the future.

#What other DeFi protocols are vulnerable to similar attacks?

Unfortunately, any DeFi protocol that uses smart contracts is susceptible to similar attacks. Hence all DeFi protocols need to conduct regular security audits to identify and remove any vulnerabilities.

#How can users protect themselves from such attacks?

Users can protect themselves by using non-custodial wallets like hardware wallets, keeping their private keys safe, avoiding unverified smart contract interactions, and keeping themselves updated about the latest security risks and best practices.