Antifragile: The Story Of The Haven Protocol
We live in a world where privacy has become a privilege for the few, it is now at a premium and our individual sovereignty is at stake. It takes a bit for that idea to sink in, but once it does it tends to change everything.
The original promise of cryptocurrency was the autonomy of the individual, but this has been eroded as governments, companies, and centralized organizations quickly caught up, leading to semi-private solutions in the crypto space.
Privacy coins were the next step in advancing the privacy fundamentals, but their inherent volatility came as a stumbling block for those seeking stability.
That’s why when the Haven Protocol announced private stable assets (in the form of xUSD, xEUR, etc.) in 2018, I dove head-first into the project.
It was a project that could offer all the privacy of Monero, but none of its volatility, giving users access to a reliable, stable coin, while maintaining sovereignty over their financial life. It’s seemed to me, that this was everything we’re as a crypto-commuity were fighting for.
And that’s why what came next came as such a shock.
We have a situation…
“What do you mean we’ve been hacked? What happened?”
It can be hard to keep your cool when the hit comes, but the true measure of an open source project is how they handle themselves when things go wrong. How and what they do to protect the future of their project.
In our case, what had happened was a hacker (or hackers), discovered a weakness in our code. This vulnerability allowed them to change the block reward for mined blocks, giving them the capacity to reward themselves with far more coins than they would have earned otherwise. This wasn’t only obvious, but blatant. It was as if they wanted us to see.
Their next move was a bit more insidious.
They modified the same area of the codebase to allow for counterfeit token creation. A hidden weakness that took us all of our experience and know-how to uncover. By that time they had made off with over $50-million in tokens and produced an existential threat to the entire Haven Protocol.
The clock was ticking.
If we didn’t do something, the unknown inflation of assets could have resulted in a very difficult position for the protocol. If our attacker converted his ill-gotten gains into XHV and crashed its price as they shifted over to BTC or ETH, the steady rolling snowball could have reduced the value of XHV to zero.
The idea of a private stable coin was in the hands of our response.
Understanding the significance of an existential threat
The response to this attack had to be handled correctly and with all due haste.
We couldn’t waste time deliberating. We couldn’t lay blame. But to say that it was ‘easy’ to handle the shock would be completely wrong. Our entire core team, myself included, had given up tremendous opportunities to be a part of this project.
From leaving well paying careers, to exiting successful online businesses – our team has made tremendous progress through tremendous sacrifice. The team and community who work on the Haven protocol believe wholeheartedly in the idea of financial privacy. It is the reason why we have all been willing to progress forward.
Witnessing the aftermath of destruction, and pushing forward to pick up the pieces that a single hack can have is extremely difficult. It is worse when years of time has been invested, entire livelihoods are at stake, millions of dollars of community investments have been stolen, and trust in the project is being questioned.
Yet despite these challenges, our team and community did not flinch.
We adopted the stance that anything that had happened in the past to cause what’s happening today, was our inheritance and our challenge.
We recognized immediately we needed to own it and fix the hack for the survival of the project.
But first we needed to prevent any further damage.
A quick and intense response
We went to the community to decide the way to go forward as a collective.
We contacted all of our exchange partners, KuCoin, TradeOgre and Bittrex, and asked them to close all XHV wallets. This ensured there would be no future deposits or withdrawals in our stolen funds.
Next, we removed the ability for conversion metrics to be calculated, effectively shutting down the hacker’s ability to convert more funds. Freezing an aspect of the protocol like this, while drastic, ensured the damage the hacker could cause would be limited.
Last, we returned to the community and inquired if they wanted to roll back the blockchain to reverse the transactions that happened in the attack. We did this knowing full well the hacker could still potentially affect any potential vote. The community, with overwhelming support and belief in the project, agreed.
We knew the next move belonged to our adversary and he did not disappoint.
Enemy in our midst
The hacker decided that causing damage to the project was not enough. He joined the community and had a lengthy chat with one of our core team members. (As an aside, the chat can still be publicly seen in our Discord channel.)
It seems the modus operandi for these types of hacks is often the same: they claim to not be in it for the money—which is doubtful. Instead, they cast themselves as an anarchic agent of chaos, sowing discord in pursuit of a “chaotic neutral perspective of life.” (His words – not mine)
They claim to want to help by poking holes in code and security to retest and strengthen and then arrive with mock concern when they find weaknesses. And yet, when approached with genuine desire to provide reward for discovering exploits as we did, they turn a blind eye.
Ultimately our hacker admitted his motives were financial.
The way forward and lessons learned
While we’ve patched the vulnerabilities and have made many changes to the way in which Haven works. Some of the notable improvements have been:
- We’ve hired an external Monero expert to test our new Haven 2.0 codebase.
- We’ve launched a public testnet to make sure Haven 2.0 has been reviewed by as many developers we could find.
- We contracted Cyber Stack, a third-party auditor, to validate both the Mint and Burn calculators.
- We implemented a comprehensive Bug Bounty Program with the potential rewards as high as $100,000 for any developers who work with the team to strengthen the protocol.
- We’ve refactored the entire Haven code base, strengthening it from the ground up.
And we’ve learned that although the attack was extremely well coordinated and potentially fatal to the project, the team and community could be counted on to make difficult decisions together – which is absolutely the strength of this project.
They can be elected and counted on to make the important decisions to ensure the security of the chain and protect new and old investors alike.
Hackers will come and go. Markets will change. But the strength of the project lies in the most important asset. It’s people.
Becoming antifragile
Our core values remain—we believe that people should be able to hold their cryptocurrency in a way that protects against volatility, but not at the cost of their privacy.
We believe that Haven 2.0 is the future of money. A protocol to provide a hedge against the steadily encroaching forces of a world increasingly committed to surveillance, dominance and control.
In closing, a $50-million hack may have punctured our code, but no hacker will ever defeat our vision. It’s that vision that keeps us, the core team and the community that supports us, together.
Now we’re stronger than ever and Haven 2.0 will change the crypto world.
The article was written by AHawk:
AHawk discovered Haven Protocol in 2018 and has been a community leader for the project since 2019. As a crypto investor and enthusiast, he believes the concept of a Monero-based private stablecoin ecosystem will truly revolutionize how people protect their financial privacy and interact with crypto in the years ahead. You can learn more about the Haven Protocol and the community by going here: https://havenprotocol.org/
Source: Read Full Article
