Update to Recent Vulnerability Report: the Post Mortem

TL; DR: On July 31st, the core team was notified with a number of possible potential exploits regarding in the Integral SIZE system that would have allowed a malicious actor to profit in specific trading situations by taking favorable TWAP trades against SIZE LPs. While we did not identify any exploits of the bug, we had paused contracts out of caution.

After weeks of hard work, the vulnerability has been fixed. At the time of publication, trading, deposit, and withdrawal have all been resumed on SIZE. Farming reward will be resumed from September 26th, 2022.

To use SIZE, please visit size.integral.link

Just over a month ago we paused trading on Integral SIZE in response to a potential vulnerability in the trading system. We have since updated our smart contract architecture to fix this vulnerability. Here is a brief post-mortem of the events and how we have responded to ensure the safety of user funds.

On July 31st we received a white hat report of a potential vulnerability in the Integral SIZE contracts via Immunefi. The vulnerability could allow an actor to observe TWAP pricing and carry out a near-riskless arbitrage by executing or cancelling trades to potentially profit at the expense of SIZE LPs.

While we determined the exploit had not been taken advantage of, we decided to pause trading on the protocol to fix the vulnerability. We have always had security as a prime concern and protecting our users and LPs was most important.

You can read more about the full details of the vulnerabilities in our previous post.

To address these, we fixed several issues with the Integral SIZE contracts:

Fixed issue that allowed executing orders only during favorable TWAP pricing

We closed a potential exploit in the execution of orders, where a user could submit an order that would fail by default due to a lack of funds in our reserves. If and only if they liked the price of the order towards the end of the TWAP duration, they could send a bit of dust into our system and cause the order to execute. This would allow them to get “free” optionality on future token prices.

To fix this potential exploit, we worked to eliminate “free” optionality. Now orders execute partially so that orders that require reserves greater than are available will execute up to our reserves and then refund the remainder.

Fixed issue that allowed increasing order size at the end of TWAP

We closed a potential exploit in our delay contract where we keep track of order amounts using a shares system to gracefully handle token rebasing. Before this, a user could submit an order into the system and if they were the only user that had tokens in the delay, they could arbitrarily increase the size of their order. So towards the end of the TWAP duration, if they liked the TWAP price, they could increase their order size. This is another example of “free” optionality on future prices.

To prevent people from manipulating their order sizes we record the actual value of their tokens in addition to their share of the pool. If during execution we notice their order size has increased, we will only execute up to the original value and refund the remainder.

Fixed issue with custom deposits

We closed a potential issue with custom deposits where some users might not be credited for funds they sent to the pool under very specific circumstances. If they submitted a custom deposit with swapping enabled and the initial deposit resulted in remainders in both token amounts, we would deposit token0 but ignore token1.

Now, we return the excess funds for the token amounts we cannot swap. We have also optimized the system to always try to maximize the amount of LP tokens depositors receive per order.

From the beginning, we have looked to protect user funds first. While the circumstances of this possible exploit made it difficult to use in practice, we have taken the cautious route and will be deploying a protocol even more secure and fair for LPs. While the potential exploit was never observed in production, we treat vulnerabilities and potential vulnerabilities seriously to protect LP funds. We also want SIZE to be fair to LPs and keep our promise of mean-zero impermanent loss. That’s why we have fixed this potential vulnerability and will continue to monitor for any potential exploits going forward.

Reach out to us over Discord or Twitter if you have any questions.

Tags

Integral Insights

Updates

May 9th, 2024

Integral Insights April ‘24

The combined average daily volume across Ethereum and Arbitrum is now at 8.8 million USD, a remarkable 22% increase compared to last month.

Product

April 25th, 2024

Introducing New Pool Analytics: Elevate Your Liquidity Provision Experience

A standout feature in our latest update is the "LP vs Hold" tab, which provides a comparative analysis of various holding strategies against Integral's LP positions.

Business

April 1st, 2024

Integral Insights March ‘24

We achieved several important milestones, including a new all-time-high daily volume for Arbitrum and the addition of four new pools on the Ethereum mainnet.

Updates

March 4th, 2024

Integral Insights February ‘24

Another milestone was reached on February 21st when Integral processed over $2 billion in cumulative volume.

Updates

February 1st, 2024

Integral Insights: January ‘24

Our initial launch with the ETH-RPL pool was a success, quickly elevating us to the second most utilized liquidity pool for this pair’s trading.

Research

January 17th, 2024

Is Liquidity Fragmentation Really That Bad?

When the token evolves into a store of value, it attracts outside traders, focusing on trading costs and slippage. This is when concentrated liquidity truly shines.

Updates

January 2nd, 2024

2023 Review

At Integral, our focus remains on developing a sustainable product for on-chain trading, serving both traders and liquidity providers.

Updates

December 12th, 2023

Integral Now Rewards Liquidity Providers with Trading Fees on Ethereum Mainnet

This enhancement enables liquidity providers (LPs) to directly receive a portion or all trading fees from Integral pools.

Updates

December 6th, 2023

Integral Insights: November ‘23

During November, Integral processed an average of approximately 6 million in volume with around 1.5 million in TVL. The system’s overall capital utilization sits at around 350%. It is the 10th most used DEX on Ethereum.

Updates

November 28th, 2023

Integral Now Rewards Liquidity Providers with Trading Fees

This enhancement enables liquidity providers (LPs) to directly receive a portion or all trading fees from Integral pools.

Research

November 15th, 2023

How Do University Blockchain Societies Gain So Many Votes?

Explore how university blockchain societies like FranklinDAO and Michigan Blockchain have grown into influential players in DAO governance, utilizing delegated votes and strategic partnerships to shape the future of DeFi protocols like Uniswap, Compound, and Aave.

Updates

November 6th, 2023

Integral Insight: October ‘23

We give an update for our work in October and highlight a profitable LP position from a long-term user.

Research

October 26th, 2023

Understanding the Stakes in Lido’s Growing Share of Staked ETH

The community is arguing whether a protocol may have too much control over the Ethereum network. Lido controls a large percentage of staked ETH, which could have consequences for the network’s future security and neutrality.

News

October 14th, 2023

Changes to Staking and Farming

Looking back at our progress so far and to the future with new updates to staking and farming.

Updates

October 11th, 2023

Integral Insight: September ‘23

We give an update for our work in September with utilization going up on higher volume for our new pools.

Research

October 11th, 2023

The Hottest Narratives of the Summer

What were the hottest narratives of the summer? Our DeFi research team delves into the growth of trading bots, RFV traders and more in this overview.

Research

October 2nd, 2023

Uniswap Governance: A Deep Dive

Governance is considered a critical component for the decentralization and community-driven development of DeFi protocols. We take a look at one of the largest goverance ecostystems in DeFi, Uniswap. In this blog post, we'll discuss the landscape of Uniswap's governance, pulling data from empirical research to dissect the system's delegates and proposals, revealing some interesting findings.

Research

September 19th, 2023

What is the DAI Savings Rate (DSR)?

Our research team takes a look at the DAI Savings Rate and its influence on various yield dynamics in DeFi.

Updates

September 15th, 2023

Integral Insight: August ‘23

We give an update for our work in August with cheaper gas fees and the launch of the Integral Relayer on Arbitrum!

Product

September 7th, 2023

Integral Relayer Launches on Arbitrum

We are excited to announce the launch of the Atomic Relayer on Arbitrum. This will bring the efficient and tested system for atomic trades to the Arbitrum Layer 2 network!