Team Finance Exploited for $14.5M Despite Security Audits

The latest exploit against crypto platform Team Finance — which lost around $14.5 million of various tokens — occurred despite a number of recent security audits, according to the company. 

The Ethereum-based project said Thursday that it had been exploited via its audited Uniswap V2 to V3 migration function. The project later said those audits had been conducted by a “reputable” firm.

Team Finance, a smart contract vault for vesting liquidity and tokens, said the exploit was not related to any specific upgrade and advised users that all other assets have been secured — after it paused all operations within an hour of the breach.

A spokesperson for the company declined to identify the firm involved, adding that a number of security auditing companies had been involved over the years, including one that supposedly had signed off on smart contract code that was exploited Thursday.

Typically, DeFi projects and protocols opt for several firms to review their code to reduce the odds of a single point of failure.

Since the project’s inception two years ago, one Estonia-based firm, Hacken, has been responsible for 80% of Team Finance’s audits. 

Blockchain security auditing firm Coinspect had conducted a review of the project’s smart contract code in March of this year while another, CertiK, undertook their audit back in June 2021.

The latest hack follows on the heels of this month’s compromised DeFi platform Mango Markets, which was drained for $112 million in a price oracle manipulation attack. 

Mango had commissioned its own audit in September which was handled by a team of security researchers at Neodyme shortly before the trading platform was hit by its exploit five weeks later.

Both instances have called into question the security of certain DeFi protocols and the integrity of their audits. 

Most projects in the industry are based on open-source code, allowing nefarious actors to peer inside a protocol’s back end to pursue potential attack vectors.

Team Finance said it had paused features on the platform and were investigating the issue alongside several firms in a bid to remediate the issue.

The team also said they had reached out to the exploiter in an attempt to resolve the issue. The exploiter’s wallet address on Ethereum has since been blacklisted and exchanges are said to have been contacted, per the update.

With this in mind, hacking is much more common now, especially when it comes to the blockchain and crypto space, as there are several tactics to do that. Nevertheless, there are a few tricks one can do once investing in crypto. 

Also, when hackings of that sort occur, it is important to keep in mind that the blockchain itself as a model is very resistant to almost all kinds of hacking, but it is the processes and systems connected to a blockchain and an asset that have vulnerabilities, and are usually targeted. Bottom line: keep an eye out, no one is really safe!