<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*BfYElX9MaJkJ53QeTrdNOA.png"></figure>On 14 October 2022, REFI suffered a security compromise. It was an exploit from the known Profanity vanity <a href="https://medium.com/coinmonks/the-profanity-address-hack-how-are-vanity-addresses-generated-cce40ba5ed39">address vulnerability</a>, a weakness that has been exploited multiple times in numerous DeFi projects (i.e. recent <a href="https://blockworks.co/wintermute-whacked-by-160m-hack-exploiting-known-vulnerability/">Wintermute hack</a>).
Unfortunately, this happened to REFI when a hacker generated the secret key of the REFI <a href="https://etherscan.io/address/0x0d1234fb3670978ce165efb01855184c888bc660">Contract Deployer address</a> (which happens to be the contract owner of the REFI token smart contracts on both the BNB and ETH chains), thereby taking control of the contracts and moving the funds to his/her own wallets.
Consequently, the REFI token contracts were taken hostage via a function that sets the contract owner, allowing the hacker to set the fee or tax per transaction (currently set to 100%, which prevents people from selling the REFI token). In addition, all claimable rewards (denominated in ETH and BNB) yet to be claimed by REFI token holders were moved to the hacker’s wallets and are currently under his/her ownership.
At the time of writing, the contracts are still under hostage to the unknown hacker, all assets are static in his/her wallet, and when REFI token holders buy/sell REFI tokens, 100% of the purchase/sale proceeds will go to the hacker’s wallet as a result of the 100% token tax set by the hacker.
<h3>How Did This Happen?</h3>
As mentioned earlier, the <a href="https://etherscan.io/address/0x0d1234fb3670978ce165efb01855184c888bc660">Contract Deployer address</a> which had ownership of the REFI tokens on the BNB and ETH chains was created using a vanity-address tool. This type of tool is easy to use, and allows the wallet owner to create addresses that may fit a specific sequence of digits. For instance, they could add their preferred digits or letters into the address (i.e. 0xrefi8K…) instead of the usual randomly generated address. However, utilizing this tool makes the address vulnerable to reverse engineering.
Vanity addresses are created by selecting a large number of private keys and deriving the public key. Once the public key looks like what the owner is looking for, they can stop the process.
However, most of these vanity tools utilize a 32-bit vector to find the right 256-bit private key. As the tool goes through many private keys at just 32-bit of complexity, it is likely to leave some of the keys easy to crack with pure GPU power. As a result, that was how the REFI Contract Deployer address was compromised.
Note: This is a simplified explanation of what had occurred.
In REFI’s case, it was the <a href="https://etherscan.io/address/0x0d1234fb3670978ce165efb01855184c888bc660">0x0d1234fb3670978ce165efb01855184c888bc660</a> address that was compromised, and the address was originally created by Founder and Lead Dev, Mathdroid.
This address had no issues for several months (10 months since the REFI token on ETH Mainnet was first deployed) but eventually became the biggest security risk, given the recent exploits of Profanity vanity addresses.
Once the hacker had decoded the private key for <a href="https://etherscan.io/address/0x0d1234fb3670978ce165efb01855184c888bc660">0x0d1234fb3670978ce165efb01855184c888bc660</a>, they had access to the address and contracts under its ownership. In this case, the contracts under the ownership of the Contract Deployer addresses included the <a href="https://etherscan.io/address/0xa808b22ffd2c472ad1278088f16d4010e6a54d5f">REFI token on ETH</a> Mainnet and the <a href="https://bscscan.com/address/0xDE734047952E178450237948cDf2ca7F24c37Ad5">REFI token on the BNB</a> Chain. All assets under the Contract Deployer, including claimable rewards (in ETH and BNB) which have yet to be claimed by REFI token holders, and the BNB liquidity pool were compromised.
Here are the compromised assets thus far:
– BNB/REFI LP on PancakeSwap i.e. 297.43 BNB ($80,257.61)
– Claimable ETH in dividend tracker i.e. 167 ETH ($216,537)
Total: $296,794 in combined BNB and ETH values.
At the time of writing, the compromised assets still sit in the hacker’s wallet address <a href="https://etherscan.io/address/0x5dd7a80b127cb35b1d8e1706430f36295a0a6fcb">0x5dd7a80b127cb35b1d8e1706430f36295a0a6fcb</a>.
<h3>Resolution Steps the REFI Team Will Take to Prevent Security Compromise Events In Future</h3>
1. A Deployer wallet will not be used in future.
2. Contract deployments will utilize temporary deployers, which will then transfer the ownership to a controlled, non-Profanity address.
3. Utilize multi-signature addresses.
4. Utilize Tenderly to monitor transactions which would alert the REFI team immediately when any wallet transactions are made.
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=b33621272c5a" width="1" height="1" alt="">

REFI Security Compromise Post-Mortem

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*EyQR_Zt5lCgn9dTB_oB39g.jpeg"></figure>The recent market slump since Bitcoin &amp; Ethereum’s all time high in November 21' caught many by surprise, and whilst at the time of writing the market has taken a positive turn it was another reminder that the crypto market is not all ‘Up Only’.
The NFT sector is where we have seen many a project struggle because of the lack of treasury management, whereby their NFT’s are sold in the native token albeit, ETH, SOL, ADA, FTM etc. and the treasury remains in that token. Great as the market continues an upward trajectory but difficult on the downward.
There are many that manage this by moving some or perhaps all to stablecoins once received protecting them from a drop but still this doesn’t provide them any yield on the stablecoins they hold.
This is where we believe ReFi Pro can assist. It may not be wise to allocate 100% of a treasury in one place as funds will need to be retained to meet short term costs, but a large portion can be deposited with USDC into a ReFi Pro vault with an aim to achieve a return of 35–40% pa.
Our Investment Team will actively manage the Treasury, which as a Full Time role will save a project from either the costs of hiring someone to manage this OR free up the Founders/Team Members time to focus on providing value to their community members.
Having our Investment Team manage the Treasury also negates the need to conduct the thorough and timely research Treasury Management requires, such things as knowing which protocols you can deposit too, assessing smart contract &amp; bridging risk, monitoring impermanent loss and optimising stablecoin holdings for the best yield whilst also managing the risk (e.g. UST &amp; 4pool). In addition our Investment Team is and continues to be ahead of the curve when it comes to new opportunities often obtaining access to products/offerings that are yet to make it to market.
Below provides an overview of Reimagined Finances offering or feel free to join our Telegram Group where we have someone available to answer any questions 24/7.
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=94943304d194" width="1" height="1" alt="">

.css-nge2y4{display:inline;background-image:radial-gradient(128.15% 697.56% at 9.91% 100%, #FF3F46 0%, #FF749E 57.68%, #FFE3AB 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}REFI is DeFiReimagined

REFI
is DeFi
Reimagined