DeFi Exploits Highlight Need for Paradigm Shift in Blockchain Security

According to Blockworks, two recent catastrophic exploits of DeFi protocols Raft Finance and KyperSwap have raised concerns about the effectiveness of audits in ensuring the security of blockchain projects. Both protocols were audited multiple times, yet vulnerabilities remained undetected. Raft Finance, a stablecoin provider, suffered an infinite mint bug, while KyperSwap's liquidity pools were drained on November 23. The incidents have led experts to call for a paradigm shift in how blockchain projects tackle security threats, emphasizing the need for a proactive and layered approach beyond relying on external audits. Halborn's Chief Operating Officer Dave Schwed highlighted the importance of sophisticated manipulation of smart contract functions. Yearn Finance security researcher Storming0x also agreed, stating that audits alone are insufficient without attention to other best practices. The challenge lies in ensuring that the audited code matches the final code in production, with some development teams ignoring the advice of their auditors. In response to the exploits, Raft Finance published a revised recovery plan, offering victims a 42% recovery rate until the end of March 2024. KyberSwap, which suffered a $48 million loss, has yet to outline a clear recovery plan. The incidents have left DeFi users questioning the level of yield that justifies their risk-taking.