[ANN] Neptune Mutual: Decentralized Cover Protocol on Binance Smart Chain

[Freemind]

It’s here at last! The Neptune Mutual gamified testnet is now live on the Fuji Network, the official testnet environment of Avalanche. We’re super excited to share with you a more comprehensive and efficient way to access parametric cover protection for your digital assets.

If you haven’t already checked it out, here’s the link https://test.neptunemutual.com/

Like the previous gamified testnet launched on the Polygon Mumbai network in March 2022, this version is designed to reward users who actively engage with the various aspects of the protocol. Purchase a policy, supply liquidity to cover pools, and report incidents to work your way up the leaderboard.

✅ More information in: https://blog.neptunemutual.com/neptune-mutuals-gamified-testnet-now-live-on-avalanche/

[Freemind]

Sovryn, a Bitcoin DeFi application, announced on Twitter that they had discovered a vulnerability affecting the lending pool, which was reportedly attacked. The protocol lost funds from two legacy lending pools: the RBTC (RSK-bridged BTC) pool, worth $900,000, and the USDT pool, worth $211, 045 USDT, totaling $1.1 million in stolen assets. The exploit was carried out due to an external call to the callTokensToSend function. The developer put their system on maintenance to avoid further losses. So far, half of the funds have been recovered, and any further losses will be fully compensated by the Treasury.

NFTs don't replace physical products; instead, they improve ideas that already exist and help them spread. Multiple industries, like the arts, music, fashion, games, etc., can benefit from NFTs beyond the ability to emphasize a digital representation of items in these industries, and many brands all over the world have started using NFTs in their operations to meet their business needs.

   • Dapper Labs has scheduled the release of LaLiga Golazos NFT Marketplace.
   • Japan is planning to use NFTs into its digital transformation strategy.
   • BSC Token Hub suffers an exploit resulting in more than $100 million worth of stolen assets.

✅ The weekly report is available here: https://blog.neptunemutual.com/weekly-report-oct-10/

[Freemind]

Decoding Sovryn’s Price Manipulation Vulnerability.

On October 4, 2022, Sovryn was hacked for approximately $1.1 million, in which the protocol lost funds from two legacy lending pools; the RSK-bridged BTC (RBTC) pool valued at $900,000 and the USDT pool valued at $211,045 USDT.

Sovryn is a permission-less, non-custodial smart contract-based system for bitcoin lending, borrowing, and margin trading built on RSK, a Bitcoin sidechain secured by the Bitcoin network. RSK's native token is RBTC, which is a 1:1 BTC peg.

The system entered into maintenance mode after the developer realized the attack. It has been reported that half of the stolen money has been recovered, and the Treasury will reimburse the remaining losses in full.

A later update revealed that all user funds that had become stuck on the ETH bridge had been released, with the exception of the user who was bridging in USDT to XUSD.

✅ The full article is available here: https://blog.neptunemutual.com/decoding-sovryns-price-manipulation-vulnerability/

[Freemind]

Decoding Mango’s Vulnerability.

On October 12, 2022, hackers were able to drain funds from Mango via price manipulation, resulting in approximately a $116 million loss of assets.

Mango Markets provides a platform for lending, borrowing, swapping, and leveraged trading of crypto assets. Built on the Solana blockchain, it uses Serum DEX for spot margin trading and Mango Markets' own order book for perpetual futures trading.

The vulnerability appears to be caused by the hackers' ability to manipulate collateral, in which they temporarily spiked the value of their collateral and then take out massive loans from the Mango treasury.

✅ The full article is available here: https://blog.neptunemutual.com/decoding-mangos-vulnerability/

[Freemind]

Decoding Stax Finance’s Vulnerability.

On October 11, 2022, the TempleDAO based project, Stax Finance was hacked, costing them approximately $2.36 million.

Temple DAO is a yield-farming DeFi protocol that offers users yields on deposits.

Stax is a decentralized application powered by TempleDAO.

The potential cause of the incident is that the migrateStake function did not check the oldStaking, so the attacker forged the oldStaking contract to arbitrarily add the balance.

✅ The full article is available here: https://blog.neptunemutual.com/decoding-stax-finances-vulnerability/

[Freemind]

Weekly Report (Oct-17).

Hackers were able to drain funds from Mango Markets through price manipulation, resulting in a $116 million loss of assets. The vulnerability appears to have been caused by the hackers' ability to manipulate collateral due to an economic design flaw, in which they temporarily increased the value of their collateral and then borrowed massive loans from the Mango treasury. Following the exploit, the Mango program instructions were frozen to prevent any further interaction with the protocol, such as depositing additional funds that may be lost. This incident effectively depleted all available liquidity, preventing protocol users with deposits from withdrawing assets...

   • India Gate Foods enters into Metaverse in an effort to preserve traditional art forms.
   • Konami is stepping up its efforts in NFTs and the metaverse space.

✅ The weekly report is available here: https://blog.neptunemutual.com/weekly-report-oct-17/

[Freemind]

Decoding Moola Market’s Price Manipulation Attack.

On October 18, 2022, Moola Market was exploited for $9.1 million. The exploit involves draining multiple tokens, including 8.8 million $CELO tokens valued at $6.6 million, 765k $cEUR tokens worth $0.7 million, 1.8 million $MOO tokens worth $1.2 million, and 644k $cUSD tokens worth $0.6 million.

After the announcement of the incident, the team halted all the activity on Moola. The team tweeted that they had informed law enforcement agencies and taken steps to make liquidating the assets difficult.

A bounty payment was also announced in exchange for returning the funds within the next 24 hours of the incident, after which 93.1% of stolen funds were returned to the Moola governance multi-sig. The attacker appears to have kept the remaining funds, earning around $500,000 as a bug bounty.

✅ The full article is available here: https://blog.neptunemutual.com/decoding-moola-markets-price-manipulation-attack/

[Freemind]

Web 3.0: How is it Different and Why Does it Matter?

When blockchain technology started making waves in 2008, no one could predict the extent of its use cases. It started with recording transaction data on an immutable public ledger where miners were incentivized to validate transactions and add blocks of data to the blockchain; these proof-of-work incentives were, and still are, the basis of many digital cryptocurrencies, including Bitcoin.

Blockchain has been responsible for numerous projects with good use cases in the Internet space. Aside from cryptocurrency, blockchain has been the technology underlying NFTs (non-fungible tokens), DeFi (decentralized finance), Metaverse, and the revolutionary Web 3.

To understand Web 3.0 better, let's do a quick review of the evolution of the web.

✅ The full article is available here: https://blog.neptunemutual.com/web-3-0-how-is-it-different-and-why-does-it-matter/

[Freemind]

Weekly Report (Oct-24).

BitKeep, a decentralised multi-chain cryptocurrency wallet, suffered a $1 million loss due to an exploit on BNB Chain via a service used to swap tokens. The vulnerability was exploited due to a flaw in BitBTC code, in which the contract used a custom bridge rather than the standard bridge provided by Optimism. Later, the team communicated and worked with major security agencies to track down the hackers and recover the stolen assets. Following the incident, they suspended their Swap service to ensure that no other asset security issues occurred again.

Moola Market, a non-custodial liquidity protocol on the Celo ecosystem, was exploited for $9.1 million. The exploit involves draining 8.8 million $CELO tokens worth $6.6 million, 765k $cEUR tokens worth $0.7 million, 1.8 million $MOO tokens worth $1.2 million, and 644k $cUSD tokens worth $0.6 million. The attacker manipulated the price of the low-liquidity native $MOO token by purchasing a portion of it, and then used it as collateral to borrow $CELO tokens back and forth in order to steal the funds. After the announcement of the incident, the team halted all the activity on Moola. A bounty payment was announced in exchange for returning the funds within the next 24 hours of the incident, after which 93.1% of stolen funds were returned to the Moola governance multi-sig.

   • Lamborghini has unveiled yet another World Tour themed NFT collectibles.
   • W3E is preparing to host the world's first live web3 eSports tournament.
   • Warner Bros has announced the release of Lord of the Rings NFTs.

✅ The weekly report is available here: https://blog.neptunemutual.com/weekly-report-oct-24/

[Freemind]

Decoding ULME Token Flash Loan Attack

In the indirect price manipulation attack, a trade on an AMM is utilised to discreetly influence the token price of a vulnerable DeFi application whose price mechanism is dependent on real-time status.

A flash loan attack can be mitigated to a greater extent by imposing a limit on the amount that can be borrowed in a single flash loan transaction, or using oracle-based services like ChainLink amongst many other precautions.

Our security team at Neptune Mutual can validate your platform for DNS and web-based security, smart contract reviews, as well as frontend and backend security. We can offer you a solution to scan your platform and safeguard your protocol for known and unknown vulnerabilities that have the potential to have catastrophic long-term effects. Contact us on social media if you are serious about security and have the budget, desire, and feeling of responsibility to do so.

✅ The full article is available here: https://blog.neptunemutual.com/decoding-ulme-token-flash-loan-attack/

[Freemind]

Decoding Melody Vulnerability.

On October 25, 2022, Melody was hacked due to a vulnerability that allowed the application's token address to be compromised, resulting in the loss of approximately 2225 $BNB tokens.

Following the incident, another attacker address repeated the attack, earning 2,450 $SGS and exchanging proceeds for 560 $WBNB.

The team took the contract to maintenance mode and restarted the withdrawal function after the bug was fixed.

✅ The full article is available here: https://blog.neptunemutual.com/decoding-melody-vulnerability/

[Freemind]

Monthly Review – October 2022.

By far one of the most exciting updates that we have for you. We’re pleased to announce that after months of back-end programming, rigorous testing, security code audits, and updates, the Neptune Mutual parametric cover protocol is launching on the mainnet in November. Keep checking back on our social media channels across Discord, and Twitter for news of the exact launch date.

Open Zeppelin is a tier 1 blockchain security company with an excellent reputation both for its security audits and for its library of smart contracts.  We commissioned Open Zeppelin to conduct a 2nd audit of our codebase and we have been working closely with them since the month of August to review and refactor the codebase to take into account their recommendations.  Security is our first priority at Neptune Mutual and the team has invested a lot of time and energy over the last few months in checking the extensive codebase of our marketplace. The Open Zeppelin audit report is now publicly available on their website and we will also be updating our website with links to this report and also the audit report published by Blocksec.

   • We continue to decode the most recent hacks and exploits in the blockchain space.
   • Start your career with Neptune Mutual.
   • The Neptune Mutual Mainnet is set to go live in November.

✅ The monthly report is available here: https://blog.neptunemutual.com/monthly-review-october-2022/

[Freemind]

Neptune Mutual Parametric Marketplace Going Live on Ethereum Mainnet, 8th November.

It’s official! Our parametric cover marketplace is set to go live on the Ethereum mainnet on Tuesday the 8th November.  The marketplace will launch with a diversified cover pool that includes cover products from Prime dApps including: Uniswap, AAVE, Maker, Balancer and more!

After over a year of fundraising, development, code audits, user testing on Polygon Mumbai and Avalanche Fuji testnets, the growth of our Neptunite community and the support of our investor community, we are delighted to be able to launch our marketplace live on the Ethereum mainnet.

Despite the tight market conditions we have chosen to launch our parametric marketplace in order to make parametric cover protection available to users. Whilst we have seen a downturn in market conditions, hacks of digital losses have been on the rise, and we firmly believe that a scalable solution to this problem is urgently needed in the blockchain industry.

✅ The full article is available here: https://blog.neptunemutual.com/neptune-mutual-parametric-marketplace-going-live-on-ethereum-mainnet-8th-november/

[Freemind]

Decoding Skyward Finance Smart Contract Vulnerability.

The team informed that the Skyward Treasury was drained due to this attack, effectively rendering the Treasury and the $SKYWARD token worthless. They added that the contracts are fully locked, meaning that no one can pause or prevent future issues with the $SKYWARD token.

The lack of a recovery plan during hacks or exploits is typically indicative of an exit scam. A few of these activities leading to rug-pull in this industry are premeditated and self-made by the team in order to avoid prosecution or gain media attention before planning for their next venture.

This exploit could have been avoided if proper validation techniques had been used to ensure that no duplicate token_account_ids were passed during the functional call. It is also recommended that such values are not passed as parameters, because they can be easily manipulated.

✅ The full article is available here: https://blog.neptunemutual.com/decoding-skyward-finance-smart-contract-vulnerability/

[Freemind]

Weekly Report (Nov-07).

Rubic, the multi-chain exchange protocol, was exploited due to malware that stole the private key following the disclosure of an administrator's wallet address, which controls the RBC/BRBC cross-chain bridge and staking rewards. The attacker sold approximately $ 303,758 worth of RBC/BRBC on Uniswap and PancakeSwap. The team said that the user's staking funds were secure and none of their smart contracts had been compromised.

Deribit, the cryptocurrency derivatives exchange, suffered a loss of approximately $28 million due to an exploit involving a compromised hot wallet. The breach was isolated and quarantined to their BTC, ETH, and USDC hot wallets, resulting in the loss of 6,967.65 ETH, 691 BTC, and approximately 3.41 million USDC, with the hacker exchanging USDC for 2,143.95 ETH. After the event, they began conducting security checks, halting withdrawals from Copper Clearloop and Cobo, among other third-party custodians. The team reported that no client assets, fireblocks, or cold storage addresses were compromised. The customer's funds will remain secure, and losses will be covered by the company's reserves.

   • Kraken has launched the beta version of its NFT marketplace.
   • Visa has collaborated with Crypto.com to auction off World Cup-themed NFTs.
   • Meta announced a toolkit for Instagram users to mint NFTs on the Polygon blockchain.

✅ The weekly report is available here: https://blog.neptunemutual.com/weekly-report-nov-07/