Recent Events & imBTC’s Future
While only a small amount of money remains lost, we will give our best to decrease risks and continue to build out imBTC as the tokenized Bitcoin.
Update on imBTC Operations: Tokenlon to cease cross-chain gateway services
Recent events left an impact on imBTC, and while we are certain that there’s nothing fundamentally wrong with using ERC777, we will need to increase our security measures when it comes to third-party integrations.
Below, we explain the actual impact, find out how we plan to help and define a future for our imBTC Bitcoin token.
The two reentrancy attacks
Recently, Uniswap and Lendf.Me experienced two attacks in which a high amount of user funds were (initially) stolen. We summarized the events in an earlier blog post here.
On April 18th, an attacker used a vulnerability with Uniswap and ERC777 to perform a reentrancy attack. Due to the lack of protection against reentrancy attacks on the platforms, the hacker was able to utilize the tokensToSend method to imBTC(ERC777) to drain the ETH-imBTC liquidity pool. For technical details please refer to Open Zeppelin’s explanation here.
As a security measure, we paused imBTC and later unpaused imBTC after an OK from partners. Again, please find the detailed timeline in our earlier post here and the pausing transactions here.
On April 19th, a similar vulnerability with Lendf.me was used to perform a reentrancy attack and steal around $25 million of user assets.
The technical root cause of both attacks lies in the way the smart contracts work together with ERC777 tokens, resulting in vulnerability to reentrancy attacks.
After the second incident, that resulted in circa $25M worth of assets being taken from Lendf.Me, our team joined Lendf.Me’s efforts to catch the hacker which ultimately led to the return of almost the complete amount of assets.
After Uniswap’s hack, we have already resolved with known liquidity providers. (Note that how Lendf.Me will exactly reimburse users is yet to be announced.)
Here is what we will improve
As usual, people are looking for ‘the responsible’ in us, ERC777, Uniswap, Lendf.Me, security companies, even block explorers and others.
We would, however, like to take a step back and see what we can do to prevent the issues that led to the incidents.
Here is what we plan to do:
imBTC will be integrated into more platforms. Recently, for example, we celebrated PieDAO’s launch of a Bitcoin token pool, which is by the way secured against reentrancy attacks.
In the future, however, we will increase our time and resources spent on any third-party integrating our products, especially imBTC.
We will also increase our communication about ERC777’s implications with third parties. If you are interested in integrating imBTC feel free to contact us at any time via email, Telegram or Twitter.
Internally, we are increasing our due diligence for working with imBTC and spend more time on educating everybody involved.
Whenever possible, we are trying to receive security reviews of integrations and urging our partners to inspect security implications themselves.
The future-proof design of ERC777
imBTC is an ERC777 token that is always pegged 1:1 to Bitcoin. 100% of imBTC’s value is backed by Bitcoin in reserve. And that will stay the same.
Is there anything wrong with imBTC using ERC777?
No, there is nothing wrong with the ERC777 token standard itself, and it is working as intended for imBTC. imBTC itself has been security audited.
Some people, however, see ERC777’s downside in the complexity it adds to ERC20’s limited features: Most importantly, contracts cannot execute code when receiving ERC20 tokens.
One of the features that ERC777 provides (compared to ERC20) is the ‘hook’. It allows you to send tokens to a contract and notify it in a single transaction (see).
imBTC users therefore don’t need to set token allowances that can be an annoyance but also a security risk (see). Second, with additional features, imBTC is future-proof for additional use cases.
Now that ERC777 is battle tested, we hope it can get more promising.
The future role of imBTC
As we set sail with imBTC we aim to bridge Bitcoin to the Ethereum ecosystem and build a seamless accessible system for the users and developers to mint, exchange, lend and to redeem Bitcoin.
Started on 10/25/2019, imBTC already achieved
- Total minted imBTC: 1675.89
- Total token holders: 1660
- Interest accrued from Tokenlon exchange: 3.28 imBTC
At the first stage we built a trustable gateway between Bitcoin and imBTC. Next we’d push forward to bridge all the current and upcoming tokenized bitcoins.
imBTC will play the role of Token-as-Gateway providing users and developers a smooth exchange of value.
To decrease current custodial risk, we are planning to move the Bitcoin into consortium custody, powered by MPC as well as a DAO for the imBTC contract admin key.
While that might take a while to accomplish, imBTC is fully backed by Bitcoin that promises 100% reserve and liability. We hope you stay vigilant and continue to use imBTC.
Make Open Finance Accessible
The Tokenlon Team,
4/25/2020
