• Blockbasis
  • Posts
  • Pike Finance: Inside the $1.9 Million Security Breach

Pike Finance: Inside the $1.9 Million Security Breach

Pike Finance swims in turbulent waters, storage vulnerability nets hackers over $1.9 million in multiple attacks.

Author

Blockbasis
May 03, 2024

TL;DR

In the tumultuous seas of finance, even the most sophisticated vessels can find themselves vulnerable to attack. Pike Finance recently found itself in such treacherous waters, as storage vulnerabilities led hackers to net over $1.9 million in multiple attacks.

Make Sure This Doesn’t Happen To You 🫵

Subscribe to Blockbasis and get access to our premium scanner to check whether your wallet or a contract is safeguarded from hacks 🔐

For a limited period only, you can get a 7 day FREE trial!

All for just $50/month after the trial.
Don't miss out! Grab your FREE trial today 👇

Chain Aegis, a vigilant guardian of blockchain security, caught wind of the latest exploit on April 30. This breach resulted in a staggering loss of over $1.6 million in ARB, OP, and ETH. Pike Finance swiftly confirmed the incident, marking yet another blow to its integrity.

This unfortunate event followed closely on the heels of a prior exploit related to a vulnerability in USDC, reported just days earlier. While Pike Finance acknowledged the initial breach, it appears that their response was insufficient to shore up the protocol's defenses.

Regrettably, the actions taken by Pike Finance post-exploit left the protocol wide open to further attacks, a critical oversight that proved costly. It's a classic case of "fool me once, shame on you; fool me twice, shame on me."

Receive weekly Bitcoin summaries with news, insights and analysis on all things Bitcoin, all for free.

Pike Finance found itself played for a fool, falling victim not once but twice to exploits that allowed attackers to seize control and siphon funds from the protocol. As a universal liquidity market facilitating lending and borrowing using native assets directly on their respective blockchains, Pike Finance had prided itself on its security measures. However, these recent events have raised significant doubts about the platform's resilience.

According to Pike Finance, the initial exploit on April 26 stemmed from weak security measures in the platform's contract functions when handling CCTP transfers. During attempts to pause the protocol, an added dependency in the code altered the storage layout, leading to contract misbehavior. Seizing this opportunity, attackers upgraded spoke contracts without admin access, successfully siphoning off funds.

What's more, the attacker also targeted Arbitrum and Optimism in addition to Ethereum, exploiting the same smart contract vulnerability across multiple networks. Quill Audits detailed the intricate process by which the attacker manipulated contract functions, highlighting the sophisticated nature of the attack.

April 26 Attack on Arbitrum

April 30 Attack on Multiple Networks

Attack Transaction on Optimism: 0x19066f7431df29a0910d287c8822936bb7d89e23

Attack Transaction on Arbitrum Transaction: 0x19066f7431df29A0910d287C8822936Bb7D89E23

Despite the severity of these breaches, Pike Finance's response has been less than reassuring. The absence of public audits and bug bounty programs raises serious concerns about the platform's commitment to security. Furthermore, Pike's delayed updates and vague promises of a "report and plan" do little to inspire confidence among investors, particularly those who participated in the $6.45 million token presale.

ic case of "fool me once, shame on you; fool me twice, shame on me."

Get Ahead In Crypto. Join 15,000+ subscribers and get our free 5-min daily newsletter

As Pike Finance struggles to regain its footing amidst these security woes, investors and users are left wondering whether the platform can weather the storm or if it's destined to sink beneath the waves of mistrust. In an industry where security is paramount, Pike Finance's cavalier attitude towards safeguarding its protocol raises red flags.

Will Pike Finance emerge from these turbulent waters stronger and more resilient, or will it serve as yet another cautionary tale of the dangers of neglecting security in the world of decentralized finance? Only time will tell.