The Oyster Pearl Debacle and Substratum Smart Contract Flaw
In light of the recent $PRL situation, another potential flaw can be found within Substratum’s smart contract allowing for tokens to be minted out of thin air
Oyster Pearl Debacle
On October 29th 2018, the transfer director function was utilized on the Oyster Protocol. This allowed the new director to essentially reopen the ICO for Oyster Pear and acquire and reissue new PRL for around $0.04 per PRL/1 ETH=5000 PRL. The individual then after doing this, sent upwards of 3 million PRL to Kucoin and market sold them for around $300,000.
Despite passing multiple audits, the Oyster Pearl team was told by Bruno Block (the original founder) that the directorship of the token contract had to remain open so that the peg could be adjusted over time. This ultimately turned into a trapdoor mechanism within the smart contract which was eventually exploited. The contract itself also was written by Bruno prior to the Oyster Pearl ICO. Bruno was the only team member who had the ability to transfer directorship within the PRL smart contract.
Official Response: https://medium.com/oysterprotocol/oyster-update-b813390ce10e
Similarly, we can find nearly the same potential smart contract flaw within Substratum. While it holds a different function purpose both can be abused in the same way. Let’s go in-depth on Substratum’s smart contract flaw which after months of saying it will be fixed has still not been fixed yet.
Substratum Smart Contract Update
In the following video published on June 9th, 2018 via YouTube, Justin Tabb addresses problems with the Substratum smart contract.
In the video, he states “Next week we will be performing some changes to our smart contract”. He further says, “It’s nothing that is going to affect your trading, nothing that affects you at all, we’re just being totally transparent here.” Then he states, “There are two functions and let me explain the reasons for them. The first one is mint token, the reason this was in there and it’s actually in our original whitepaper we talked about it a lot in the beginning, is that our original idea was that if we ever got to a point where liquidity was low in the network and where there was less than 10% liquidity, in this instance everybody will be holding and not releasing their tokens. If we ever got to this point we wanted to make sure that we had a way to basically add tokens so that the network could continue to run”.
Some key takeaways from Tabby’s long and drawn out response. Firstly, you cannot “update” a smart contract, you need a new one and there will be a token swap following that to the new contract. Substratum’s smart contract address is also executed by a single party for the mint token function, that person being Justin Tabb. The only way that function gets executed is if Justin does it. According to Justin, “It hasn’t and won’t ever be executed, and we will remove it”. After 4 months hopefully, it will be removed within this century. I guess we are only left to “Trust” Justin much like how people trusted Bruno… we see what happened there.
Also, we see Tabby mention that the function was in the “original whitepaper”. There are 2 Substratum whitepapers. Why are there 2 whitepapers when you can update the original following ICO and remove the first?
Substratum Whitepaper August 14th, 2017
Substratum Whitepaper December 2017
In the first ICO whitepaper there is not a single place where it mentions the minting function and ability for the team to create tokens out of thin air. Then, we see a second whitepaper made AFTER the ICO is done and the SUB team decides to make a disclaimer about it on there. How convenient, we see a pre ICO whitepaper and a post ICO whitepaper that conveniently says “Oh, btw we can mint new tokens out of thin air”.
Fast forwarding to a interesting point he says in the video, “However, we’ve just come to realize that we don’t need this, so we got plenty of liquidity and there’s no reason to have this function”. They have came to realize that not only did they not have a disclaimer in their first whitepaper about the minting function, but also have not acknowledged this in 4 months. With the recent Oyster Pearl debacle this is extremely concerning and it’s made it abundantly clear that these types of concerns are far from outlandish. On top of this they are also leaving in the second function which is the freeze token function within the smart contract.
Binance Announcement
The official announcement of these findings and problems with the smart contract came from SUB’s largest listed exchange by volume, Binance which accounts for 98% of their total volume. Binance found the flaw and contacted the team about it. In reality, this would never have been made public if Binance did not do a thorough review of Substratum’s smart contract.
The announcement essentially was a straight up lie. There isn’t even monetization yet for Substratum NODE so how do they know if they will have enough liquidity? Especially when they are giving away “60 million SUB” to fuel the Substratum Network, which to this current day is still nonexistent.
Here below, the team talks about pulling SUB out of the 60 million SUB dedicated for fueling the network.
Then, in an interview with Young & Investing via YouTube, Tabby is singing a completely different tune about the smart contract.
Some key takeaways here.
- The team is still claiming the issue of the smart contract is in their own review
- Freeze function is again not mentioned
- It’s turned into now “A complicated and expensive process”
- “Will change more things” This is a given if you want to incorporate a dex, cryptopay, and automatic distribution when you boot up and run a Substratum NODE.
The Current State of Substratum’s Smart Contract
Regardless, the official announcement was a smart contract update “within a week”. Everyone seems to think this is what happened since there were no other announcements about it. However, in light of the recent Oyster Pearl debacle we can see that concerns like this are not only relevant at this time, but far from being considered “FUD” by the permanent residents of Substratumville.
We can see clearly within line 136 of Substratum’s smart contract clear as day, the owner of the contract can mint infinitely more new tokens for free.
To add to this further, all the tokens that were claimed to be burned or have yet to be this century are still sitting in the Substratum Crowdsale wallet. I don’t know about you but that looks like multi millions just sitting in the team’s pockets.
*Also, the team did a token burn without sending the Substratum tokens to a zero address. This is a common practice within token burns to send tokens to this address. Justin Tabb’s defintion of a token burn was creating a new ETH wallet and sending 60 million SUB to it before saying the following line.. “Alright there’s the private key which I’m not writing down so I have no idea what it is”.
Absolutely remarkable, this video deserves an Oscar.
If that’s not such a mess when people asked for clarification on why the team did this the response was the following.
- “This is not a security issue since only the dev team has access to it”. Bit of a problem there isn’t it? They should not even have access to it in the first place, this is essentially like saying only Bruno from Oyster Pearl can do it anyway! Which we saw how that worked out…
- “The blockchain is public anyway so you can monitor any transactions”. Again, most trusted and common practice is to send burned tokens to a zero address. Why they did not do this is odd and shady.
All this serves as a reminder to any intelligent observer that the reason we are using blockchain is that we should not be trusting people. Yet here we are trusting Tabby.
Conclusion
The team clearly has not the slightest clue how smart contracts work. As I mentioned earlier there is no such thing as a smart contract “update” you need a new one and there will be a token swap following that to the new contract. There is also absolutely nothing stopping them from minting new tokens and selling them on the market at their own discretion like Oyster Pearl did. Their contract can be abused in a similar function as Oyster Pearl. In fact, the Substratum contract is even more desirable to abuse since it doesn’t require the culprit to send any ETH to collect the freshly minted SUB.
In light of all the drama with Oyster Pearl, these concerns are far from outlandish and need to be addressed yesterday. Proceed with caution.
EDIT:
Trending Reddit post on Smart Contract
A thorough analysis of SUB Smart Contract:
Disclaimer: I am not a financial advisor nor am I suggesting to buy or sell speculative crypto assets based on the content presented in the article. As always do your own due diligence.
