About Defibox 20220531 Security Incident and Bounty Program Announcement

Dear user:

Hello! At 23:08 (SGT) on May 31, 2022, Defibox received a feedback from a user (account boxfan.mlt, itshaejinlee) saying that the lending protocol has high-risk vulnerabilities. Defibox team entered into emergency status immediately and suspending the lending and the USN Btoken generation function at 23:19 (SGT) on May 31, 2022. At present, the bug has been fixed and the contract has been opened. This incident satisfied Defibox Bounty Program standard. The incident and solution are described as follows:

Incident:

Account boxfan.mlt deposits BOX through lending (contract lend.defi) and then borrow USDT, and then the account transfers BBOX to USN (contract danchorsmart) to generate USN. After the operation, (contract lend.defi) the collateral in that account is 0 and creates a bad loan. The detailed on-chain operation record TX ID is:

• Deposit BOX to the lending contract:
  fcbbfcc20154f0ee0d62e1544fb9564b61f3dba337605d916bf42a8d1320c601
• Borrow USDT from the lending contract:
  4cc220a209ede6adbb1e87db7f25ddfe01406ddbe88e7e70ddc345fc26c8bdde
• BBOX transfers to the USN contract and generates USN:
  f849a5741ffd7d967dd980dfcaee671dc5fc25dccd933debe1cf08804cf05a3c
  (This step occurs the bug, and BTOKEN as collateral should not be allowed to transfer)

The user immediately reported to the Defibox executive team after finding the bug. The Defibox executive team immediately activated the emergency plan after confirming the existence of the vulnerability, suspended the lending function and the USN's Btoken minting function, and immediately repaired the vulnerability. Sign multi-sig, release production and open related contracts.

Solution:
After discussion by the Board, the user who found the bug and gave feedback to the team in time prevented a greater losses for Defibox. It satisfied the bounty program standard and is rated as high risk. This bug affects the security of contract funds. The reserve fund will be used and the reward amount is $10,000.

The Defibox Security Bounty Program aims to motivate community developers to do vulnerability and stress tests on the protocols and products of Defibox, and to enhance the open source process of Defibox. We hope that every Defibox user can participate in Defibox project and help to build a better Defibox!

Reward distribution (converted to 7310EOS) TX ID：

02341131a365c182277d55d13435afbcfa5d2457ce251bc844db59be4cfdbff9

Bounty Program: Click to view

Defibox community:
International Community：https://t.me/Defibox_official
Chinese Community：https://t.me/DefiboxCN

Thank you for your support and attention to Defibox!
Defibox Project Executive Team
June 1, 2022