Introduction
Imagine going to your bank and sending $100 to someone. Later, you discover that by doing so you have allowed this person to empty your bank account. Even worse, your bank did not do a thing to prevent this from happening, even though it knew this could happen.
This is the problem that we have encountered in some of the most popular crypto wallets, while we were building Zengo Savings. We call this issue baDAPProve, and in the following article, we will demonstrate what it is, why it’s important, especially given current market turbulence, and how we are solving it in Zengo Savings.
What is baDAPProve?
DeFi companies build DApps (Decentralized Applications) to give users access to their DeFi services, implemented as blockchain smart contracts. In turn, users interact with DApps by connecting to them with their crypto wallet.
When connecting a DApp with a wallet, the user is asked to approve access to their tokens. This process is required to allow the DApp to interact with the user’s wallet.
The security issue is that while most users assume they approve access for a specific transaction of a specific amount, in most DApps users actually grant access to ALL of their holdings in that token. As a result, if the DApp is vulnerable to a security issue or is rogue to begin with, attackers can abuse these highly excessive privileges to steal ALL of the DApp’s users holdings (in the approved tokens) without any further user consent. They can do so at any point in the future, even if the user no longer uses the DApp.
In almost every DApp, when the user connects to it, they unknowingly provide the smart contract associated with the DApp, full access to all of their funds, regardless of their actual usage. Therefore, even if the user only actually sent a transaction equivalent to $1, an attacker abusing a smart contract vulnerability can withdraw all of the user’s holdings of that specific asset.
The situation is aggravated by the fact that many wallets do not communicate that fact to their users.
baDAPProve: A rogue DApp demo
To raise awareness of this issue, we have created a publicly available testing site in a protected environment with a rogue token swapping Dapp. Using this site anyone can experiment with this security issue using testnet funds, without actually losing their money.
The experience is simple, as seen in the video below.
- At first, there is a short setup phase: the user creates a wallet and adds some testnet FRT tokens (so no real money is lost).
- Once the setup is done, the user can interact with baDAPProve, our rogue swapping DApp. The user sends a few FRTs to the DApp in order to swap them. But to their utter astonishment, not only did they lose the FRT they agreed to send on their own risk – the user’s entire FRT balance is gone!
One of DeFi’s growing pains
One of the most interesting things about this security issue is that it is not new, and has been known within the community of Ethereum developers for years. However, the current rise of DeFi has changed the security equilibrium and requires a rethinking of the security decisions taken in the past.
Some security compromises that might have been acceptable in the era when users were scarce and highly technical are not acceptable when DeFi goes mainstream, acquiring many non-technical users, and handling crypto tokens in the Billions (USD).
Furthermore, the recent price drops in DeFi only aggravate the problem, as users who decide to move out of DeFi falsely assume they no longer carry this risk, when in fact, they are still as vulnerable to the baDAPProve issue as they were before.
In Zengo, we believe that a crypto investment app should be, first and foremost, safe. Therefore, when we had done our research to support our first DeFi integration with Compound protocol, we knew we could not let our users be exposed to such unnecessary risk. Today we share this solution with the community in an open-source project.
baDAPProve in Popular DApp Wallets
We checked what some other popular wallets are doing. To be honest, wallets are really between the rock and a hard place. As one wallet provider replied to us: “this kind of approve call from DApps is a common practice and the meaning of these calls is difficult to communicate to users in a way that is understandable”.
Still, some do better than others: Brave and Metamask wallets display a meaningful warning to users before calling approve() and let users adjust the approved sum under advanced settings. Coinbase wallet displays a meaningful warning. We assume that even with these warnings, users just confirm the transactions, but this is probably the best that can be done if a wallet wants to support the existing DApps.
In contrast, some wallets give no clue to their users that they are about to grant full access to their tokens. We have contacted Opera, Imtoken and Trust wallet on this issue. They all said they are aware of it, however, only Trust wallet is planning to upgrade their wallet as a result of our inquiry.
ImToken’s public response (Source: Twitter)
Zengo’s baDAPProve Solution
To solve the baDAPProve issue, a core problem in DApps must be solved.
Luckily, a DApp is only one way to access a protocol and its smart contracts and not “the only” way. Just as we have created a new user experience for Compound, we also developed a security solution that solves most of the double confirmation issues: The approved sum is the same as the sum that the user intends to send, the user only approves once and both transactions are sent in parallel so the user does not need to wait any longer than usual.
This solution is not specific to Compound and we plan on using it with our future DeFi integrations. You can check it at https://github.com/Zengo-X/compound-playground.
We will soon publish a detailed technical blog about the solution.
Additionally, users’ can check whether they’ve been exposed to the baDAPProve issue using this third party (not developed or tested by Zengo) public tool
Token allowance checker tool
Conclusions
Decentralized Finance (DeFi) is one of the most important crypto narratives today. In Zengo, we are committed to supplying our users with access to multiple assets and multiple earning possibilities in a very user-friendly manner. We believe great user experience does not need to come at the expense of top-notch security and we will continue to work in supporting these core pillars of our solution.
