How NEAR Intents Identified a Suspect and Got Its Stolen Funds Back

Alex Shevchenko (0:00)

But imagine if you're finding the vulnerability, you are reporting this vulnerability, you're getting a bug bounty, bug bounties are pretty high, bug bounty that is enough for you to buy Lambo, and then you are a king on the cocktail parties, and then all of the girls are around, and you're saying that you are the guy who discovered this, and by the way, do you want to hop in my Lambo, that I got to hop in there? This is much better.

Laura Shin (0:31)

Hi everyone, welcome to Unchained, your no-hive resource for all things crypto. I'm your host, Laura Shin. Thanks for joining this live stream, and first we'll take a quick word from the sponsors who make this show possible. This episode is brought to you by Oneinch Aqua, the shared liquidity layer from Oneinch. Back multiple liquidity positions with one wallet balance, and keep your tokens in your wallet until a swap fills. See how it works at oneinch.com/aqua.

Before we get started, I want to ask you for something. We're making a bunch of decisions right now about Unchained. What we make next, when we go live, what we should be doing more of, and I'd rather hear from you before we make them than after. So we put together a survey. It takes just a few minutes, it's anonymous, and there's a box where you can tell me what we could be doing better. I read all the responses. The link is in the show notes, or you can snap the QR code on screen, or go to unchainedcrypto.com/survey.

Today's guest is Alex Shevchenko, GM of NEAR Intents. Welcome, Alex.

Alex Shevchenko (1:36)

Hello, Laura. We're happy to finally be here.

Laura Shin (1:38)

Yeah, nice to connect. So last Thursday, NEAR Intents had to halt services after someone exploited a bug, causing the protocol to lose $3.8 million.

Explain what happened.

Alex Shevchenko (1:52)

So this was a complicated bug in between the Omni infrastructure that is taking care of the region of the assets inside of the protocol. NEAR Intents is a complicated protocol that spans across multiple networks. That's why we need to coordinate the interaction between these networks.

And this infrastructure has been interacting with the NEAR side of the protocol and the smart contracts of the NEAR. And within this coordination, highly asynchronous coordination, there was a bug and the attacker has been exploiting it. Extremely complicated bug. This was audited multiple times. Unfortunately, our auditing companies were not able to discover this mode of operations and this sequence of the actions that was leading to the exploitation of this bug.

Laura Shin (2:38)

And before we keep going, just explain for anyone unfamiliar what NEAR Intents is and what relationship it has to NEAR Protocol and near.com.

Alex Shevchenko (2:48)

Yeah, obviously. So, NEAR Protocol itself is a layer one blockchain. It is scalable with a bunch of interesting characteristics that it has. Advanced account model. There is also a private chart that is available there. And lots of additional technologies like Chain Signatures, which is the MPC network that allows NEAR smart contracts to have their own private keys.

Now, NEAR Intents is one of the applications that is built on top of NEAR Protocol. And so what NEAR Intents does is combines all of the existing blockchains into a single interconnected unified liquidity layer. The whole idea is to simplify the flow of liquidity in between different chains, as well as the usage of the Yields and the different other DeFi primitives. You can think of it as like a swift of all of the blockchains, if different blockchains are countries, or some kind of like a tissue that connects all of these blockchains and specifically financial use cases.

The most prominent use case for NEAR Intents is a cross-chain swapping of the assets or trading or spot trading of the assets. So for example, people are using NEAR Intents to trade Bitcoin into ETH.

NEAR Intents is available to our business partners and to anyone through a very simple API. And this API is used mainly by the wallets to integrate swapping functionality directly into their frontends. We are serving ledger, trust wallets, many other wallets. And in general, at the moment, we are the leader of the cross-chain market swapping. And we are serving approximately 50% of the swapping volume. I'm excluding here stablecoin bridging or ETH movement in between L2s and mainnet, for example. And near.com is a frontend that is our own frontend that implements the different functionality of the Near Intents protocol. I hope it's now clear what is the gradation in between these things. So near is Ethereum, Near Intents is Uniswap, and near.com is uniswap.org. That is kind of a very simple analogy there.