Last week I ran an analysis of wstETH transfers and noticed the single largest transfer of wstETH occurred earlier in the week. At +$220M, it was a clear outlier, so I investigated.
After 24 hours of retracing actions across multiple wallets, I pieced the puzzle back together. I accidentally stumbled into Jump successfully facilitating a counter exploit against the Wormhole hacker who stole 120,000 ETH last year. Our free report takes a step-by-step analysis of how the recovery was executed.
After the report was published, Oasis announced that they "received an order from the High Court of England and Wales to take all necessary steps that would result in the retrieval of certain assets involved with the wallet address associated with the Wormhole Exploit."
A court ordered Oasis to take on-chain actions to allow the recovery of the funds, and they, obviously, complied. Oasis is not a decentralized protocol, so it is not immune to regulatory demands just because it builds on blockchain rails. I am fairly certain this is the first time a court has ordered an entity to take specific on-chain actions, but if not, then it is certainly the largest by USD value. We do not know the full specifics of this court order, but it is interesting they were able to verify the funds originally belonged to Jump and could be reclaimed. Did they do their own blockchain analysis?
I have seen a lot of "DeFi is dead" takes on my Twitter feed from this. Relax.
This is a specific instance where [1] a multisig controlled by known individuals [2] based in a regulation-friendly jurisdiction [3] controlled an upgradable contract that could be used to [4] target one specific user because [5] the user gave control of their assets to the upgradable contract.
All five elements were required for the funds to be recovered. I am strongly of the opinion that this was only considered an acceptable path by the courts given it solely impacted the Wormhole exploiter's vault. No other Oasis users lost funds during the counter exploit, and it is not likely they ever will — unless they steal 120k from one of the largest and most sophisticated trading firms in the industry.
Upgradable contracts are not inherently evil. Multisigs are not inherently evil. However, users should be aware that giving control of their assets to an upgradable contract owned by a multisig is a centralization risk.
Decentralization is a spectrum, and it spans through time. It is an end goal we must build toward, not one we begin at.
- Dan Smith
No comments:
Post a Comment