In late April, anonymous developer Molly Wintermute launched the Hegic DeFi protocol. She ordered a code audit from the well-known company Trail of Bits, but this did not help to avoid problems. A day after the launch, a common one-letter typo in the code resulted in the loss of almost $ 48,000 of user funds. Wintermute returned the funds, restarted the protocol and believes that DeFi users should be prepared for risks for the sake of high profits. The Hegic incident clearly illustrates the problems of security standards for DeFi protocols: the rush to develop and audit, and, as a result, the loss of funds. How the Hegic launch took place, what problems Wintermute faced and what results it managed to achieve by July

Hasty launch of Hegic

Hegic - DeFi options trading protocol, independently developed and launched immediately on the Internet by anonymous programmer Molly Wintermute .

Molly Wintermute on Twitter. Source .

The main idea of ​​the project is to simplify the work with options as a financial instrument. Optional smart contracts give you the right (but not the obligation) to buy or sell a specific asset before a certain date or at an agreed price. In essence, option contracts are a rate with borrowed funds on whether the price of an asset will go up (call option) or down (put option) over a certain period of time. Hegic supports ETH, which allows any user to access the loan rate on the price of assets in any direction.

In Hegic, any user can sell option contracts and earn bonuses automatically. If the contract is not fulfilled and expires, sellers (liquidity providers) receive a premium for the sale of the contract and undertake to comply with the strike price if it is paid off.

The main difference between Hegic and other similar option protocols (for example, Opyn) is the collective risks in the sale of contracts. Usually, when traders sell an option contract, they only risk funds in that particular contract. However, Hegic diversifies this risk across all pool liquidity providers. Thus, sellers share risk and reward for all contracts issued from the respective pool.

For the first time the work on the protocol Uintermyut announced in early January of this year. In early February, a technical description of the project was posted and a website was launched. In March, the first users began testing Hegic.

$ 48,000 typo

In April, Wintermute ordered a Hegic code audit of the well-known audit firm Trail of Bits - the protocol was verified. Confident of his safety, on April 23, the developer launched the Hegic Mainnet.

But on April 24, Wintermute was forced to restart the protocol. The reason was a simple typo in his code - instead of the “OptionsIDs” function responsible for unlocking liquidity in expired contracts, the non-existent OptionIDs command was written - without the letter “s”. The error led to a failure, the contract was not executed and as a result, user funds in the amount of $ 28,537 in ETN and DAI were blocked forever - they cannot be unlocked in expired contracts. Wintermute could not correct the typo retroactively - the protocol simply did not provide for such an opportunity.

A typo in the Hegic code, which led to the loss of user funds. Source .

Wintermute noticed an error on her own, warned users about it on Twitter, Discord and Telegram and quickly corrected a typo. She asked active option holders to exercise their contracts in order to avoid blocking their funds on pool contracts forever. Those who managed to contact Wintermute managed to return the funds, and the rest of the developer promised to fully compensate for the lost assets. The very next day, Wintermute issued a detailed report and talked about the three mistakes that it made when Hegic launched:

 Decided that correcting the comments of the auditors guarantees code security;

 Did not conduct automated code testing that could reveal a typo;

 Made speed, not safety, a priority in the development of the project.

Then Wintermouth promised that the error would not stop the development of Hegic: she would double-check the code in accordance with the most stringent security requirements and would soon restart the protocol.

Later it turned out that the losses were one and a half times higher. On May 9, Wintermute clarified that $ 47,765 was permanently blocked in smart contracts - the developer claims that she has already reimbursed users for all the lost funds.

Audit Competency Dispute

After the incident, Trail of Bits, which tested the Hegic code, was criticized. In response, the head of the company, Dan Guido, said that code verification is not a security check, but rather a summary of recommendations for developers to understand the shortcomings of their code and fix them. He also noted that Trail of Bits did not have enough time to thoroughly verify the Hegic code. In comments to Decrypt, he said the incident was “ a clear mistake that would have been easily detected if any unit tests had been carried out.””, That is, checking the correctness of individual modules of the protocol code in different situations of use. According to him, the Trail of Bits team found 10 critical flaws in the Hegic code and recommended delaying the launch of the protocol on the main network. However, Wintermute ignored error warnings and a number of critical flaws, hastily launching an unverified protocol. This gave users the false impression that Hegic is safe.

In her post on April 26, Wintermute said that she initially wanted to order a weekly audit, but Trail of Bits convinced her that a three-day check would be enough. In support of her words, she provided screenshots of the correspondence. The developer made changes to the code according to the audit recommendations, but this did not save her from an error.

Smart contract auditing is an important part of checking the security of DeFi protocols. The crypto community perceives it as a guarantee that the code is reliable and no errors will occur. However, as the Hegic incident showed, audit firms themselves do not believe that auditing protects against problems. In any case, it is obvious that at the time of activation, Hegic did not pass a full check and a number of unresolved security issues remained.

Work on the update and another mistake

On May 9, Wintermute launched a new version of Hegic. Before that, she conducted automated tests, noticing and correcting a number of new problems. This time, the protocol was launched without any audit at all, which the developer honestly warned users about: “ You can lose up to 100% of your funds allocated to contract liquidity pools. There is a technical risk that contracts for a new version of the protocol may be hacked. Never invest money that you cannot afford to lose . ”

However, on May 21, another mistake was discovered in the Hegic protocol. The crypto investor Andrew Kahn drew attention to her . In a series of tweetsHe said that there was a defect in the protocol code that allowed earlier liquidity providers to profit without meeting their obligations. Liquidity providers that sell option contracts (short options) receive their premium and may withdraw from the pool after collecting it. The problem was that later liquidity providers were then forced to bear all the risks, as earlier suppliers could pick up their premiums for options and quit. This vulnerability was exploited by Kahn - he first deposited liquidity, then bought put options, withdrew liquidity and exercised options. This brought him profit without risk, but caused later liquidity providers to suffer greater losses than they expected. Wintermute did not comment on Kahn's tweets.

In May, Wintermute audited a new version of the Hegic protocol, ordering it from Bramah Systems.

Hegic June Results

An updated version of the Hegic protocol was activated on June 1, and the code was posted publicly on GitHub. On July 1, Wintermute reported on the results achieved for the month:

 Trading volume - 220.24 ETH;

 Traded in call options - 164.82 ETH;

 Traded in put options - 55.42 ETH;

 The total value of the blocked funds is $ 39,145, of which $ 31,411 in ETH, the rest in the DAI pool.

The developer did not mention any errors in the protocol for the month.

Earlier this month, Wintermute also gave an interview to The Defiant platform, in which she spoke in more detail about the work done and the launch of the protocol. She claims that she fixed all the mistakes, changed her approach to development and now puts quality above speed. Wintermute also said that she is working on creating her own project tokens.

For those who doubt the safety of Hegic, the developer gave a simple recommendation: “ Do not use it. So far, the ratio of risk and reward using the Hegic protocol does not suit many people. Just watch, learn and envy the high incomes of other people from trading options on Hegic (joke) . ”

She said that the profitability of the pool of liquidity providers on ETH is about 25% per annum in ETH. Wintermute believes that if someone wants to make such a profit, then he should be ready to contribute funds to recently launched protocols. “ The greatest opportunities are always far from the current attention of the herd ,” she said, noting that once Ethereum was also a raw product, but those who believed in it did not fail.

Answering the question why she launched Hegic immediately on the Internet, Wintermute said that “ one protocol launched on the Internet costs thousands of projects whose creators have been developing them for many years and play with new approaches that they find by visiting various hackathons ” . The developer also noted that she had already paid a high price for her approach to launching protocols.

Finally

Security is the main problem of the new crypto sector. DeFi protocols are constantly attacked by cybercriminals. The story with Hegic showed that funds in DeFi protocols could be lost through the fault of developers - due to excessive rush.

A typo incident in Hegic is another lesson for DeFi. The ecosystem is developing at such a fantastically fast pace that it does not have enough time to test and verify its services. If Wintermute took at least a month to test, then there would be no problem. Actually, in May, she independently identified and corrected several errors. If the Trail of Bits were more attentive, the error would also be easily noticed. But if code auditing does not guarantee its security, then what's the point?

Obviously, what happened is not only the problem of Hegic and its users. The entire DeFi industry needs stricter safety rules, without which it will not be ready for mass adoption. To make DeFi products safer, you need to conduct comprehensive audits from different companies, as well as insurance against errors in smart contracts and hacker attacks. Otherwise, users will lose money more often.