We provide professional blockchain forensic investigations, KYC Services and Researching and Risk Analysis for Projects and Communities.
KYC is a critical tool that enables a fine balance between project founders or developers remaining anonymous, whilst maintaining trust.
Whether you're a part of a DAO or an individual, we deliver professional reports using a wide-range of techniques to help you better understand on-chain events
Has your community been scammed? We can help you make a stand against bad actors. IOC can work with the community to explore civil or criminal routes.
We have years of experience assessing risks within DeFi, NFT and Blockchain projects. If you require Risk Analysis, enquire below.
We can support anyone who has been impacted by a financial fraud, scam or a rug pull. Leave as much information in the form as you can, and we'll get back to you
From DAOs to Governments and anything in between, we support all entities that require forensic blockchain analysis to be completed
We're able to support communities impacted by rug pulls. We're able to fund investigations using a variety of methods, including crowd funding.
Beanstalk is a decentralised protocol that allows anyone to realise the value of an open, credit based stablecoin. The Beanstalk community of lenders, borrowers and savers secures a protocol-native stablecoin, Bean, with the goal of creating the world’s most accessible digital money system. By eliminating collateral requirements, Beanstalk aims to be the catalyst for a trustless solution to unlock the universal potential of decentralised finance.
Beanstalk, a decentralised credit based stablecoin protocol, was attacked at roughly 12:24pm UTC on April 17, resulting in a theft of ~$77M in non-Beanstalk user assets. The perpetrator used a flash loan to exploit the protocol’s governance mechanism and send the funds to a wallet they controlled.
On the day of the attack, the Beanstalk contract on the Ethereum mainnet was exploited via a previously-unknown issue with Beanstalk’s governance process. The Beanstalk Farms team was immediately alerted and took action to temporarily shut off protocol governance and pause Beanstalk. Approximately $77M was stolen from the protocol’s liquidity pools. The team has since burned the remaining Beans in the exploiter contract.
Contract Vulnerability
The root cause of the flaw is that the BEAN3Crv-f and BEANLUSD-f (used for voting) in the Silo system could be created via flashloan. However, lacking anti-flashloan mechanism in the Beanstalk protocol, the attackers can borrow numerous tokens that are supported by the protocol and vote for malicious proposals.
In detail, to execute the proposal by “emergencyCommit()”, the attacker needs to bypass the following checks: CV1
As the BIP18 proposal was created one day ago, validation one will be bypassed. By flashloan, the BIP18 proposal gained more than 78% of the vote, which is more than 67%.
Exploit Transactions
Propose BIP18: https://etherscan.io/tx/0x68cdec0ac76454c3b0f7af0b8a3895db00adf6daaf3b50a99716858c4fa54c6f
Launch attack to execute BIP18: https://etherscan.io/tx/0xcd314668aaa9bbfebaf1a0bd2b6553d01dd58899c508d4729fa7311dc5d33ad7
Contract Addresses
Victim Contract: https://etherscan.io/address/0xc1e088fc1323b20bcbee9bd1b9fc9546db5624c5#code
Attacker address: https://etherscan.io/address/0x1c5dcdd006ea78a7e4783f9e6021c32935a10fb4
Malicious Proposal: https://etherscan.io/address/0xe5ecf73603d98a0128f05ed30506ac7a663dbb69
Attacker Initial fund activities: https://arbiscan.io/address/0x71a715ff99a27cc19a6982ae5ab0f5b070edfd35 https://debank.com/profile/0x1c5dcdd006ea78a7e4783f9e6021c32935a10fb4/history
Our KYC process enables project founders, developers and team members to privately verify their identity. This in turn helps to build out credibility and trust within their community
Use the form below to begin the kyc verification process. We'll get back to you with 24hrs for a quick turn around. Be sure to give us as much detail as you can, including how many people, project name and contact details.
Our professional team will meet with you to go through the kyc verification process. This is one quick meeting once an agreement is in place. This is when we'll gather your personal data, record it and store it offline in a safe.
Once the verification process is in place, we will airdrop you an IOC NFT that represents our certification. You'll be able to use this NFT as proof that you have completed the KYC process with us.
We'll get back to you within 24 hrs
We provide full end-to-end risk assessments for Web 3.0 projects using our strict scoring system, enabling Web 3.0 projects to prove their transparency.
Lemono is a browser extension that aspires to be the PayPal of Crypto. At the start of September, the team commissioned IOC conducted a full end-to-end deep dive to understand the level of risk associated with the project, demonstrating the ultimate level of transparency.
We have completed our deep dive review of Lemono. It is important to note that IOC did not audit the smart contract/s and our scores reflect the latest information available at the time. At the time of publishing, the contract/s has NOT yet been deployed and you should ensure you double check the address versus the audits prior to participating.
The Lemono team have demonstrated a commendable level of transparency throughout this deep dive risk assessment. Each question has been met with a prompt response and supporting evidence where required.
Provide the ultimate demonstration of transparency to your community! Request a deep dive risk assessment today!
Copyright © 2024 Intelligence On Chain - All Rights Reserved.