Binance and Bitfinex stand among the global leaders of cryptocurrency exchanges. Our investigations have spotlighted two notable QA/QC issues, suggesting potential flaws in their back-end and blockchain interactions. Such issues may inadvertently expose internal information.
The Intricate Connection Between QA/QC and Cybersecurity
The symbiotic relationship between Quality Assurance and Quality Control (QA/QC) and cybersecurity cannot be overstated. Multiple software bugs can become avenues for vulnerabilities. The rise of the Internet fueled the computer security industry. In its infancy, a single bug could be exploited. Today, crafting a significant exploit might require a team of security professionals, taking a considerable amount of time, and could have geopolitical repercussions. The value of such an exploit can be astronomical, a fact evident when looking at incentives like those from ZERODIUM for zero-day exploit research. In the cryptocurrency realm, the stakes are even higher, as software bugs have a strong correlation with financial hacks. A study by BitTrap, led by Andrés Rieznik et al, deduced that as the Total Value Locked (TVL) escalates, so does the chance of a hack.
Unveiling the Bitfinex and Binance Conundrum
The issues with Bitfinex and Binance are tied to their interactions with the Algorand blockchain. Algorand has implemented measures to counteract AirDrop spam by forcing opt-ins for ASAs (Algorand Standard Assets). Essentially, if a user hasn’t opted in for a particular ASA, a transaction involving that ASA will fail. Algorand users should be aware, especially when transacting popular assets like USDT and USDC stable coins.
Despite Algorand’s impressive transaction and finalization speed (under five seconds) it’s been observed that recovering from an ASA transaction, which a recipient hasn’t opted into, can span hours or even days on exchanges such as Binance and Bitfinex. This suggests an oversight in the exchanges’ processes: the absence of an “if user opted-in” check before initiating the entire transaction process. With cryptocurrency custody in the equation, it’s evident that valuable resources are wasted because of this omitted check. Even more, these types of bugs many times serve as a perfect opening for sharks to start circling around and probing for potential exploits. Let’s emphasize that we are discussing a detectable QA/QC issue.
The Urgent Need for Standardized Web3 Quality Assurance
It is clear that there is a lack of standardized, well-established Web3 quality processes as a counterpart to security auditing practices in the decentralization ecosystem. In the realm of blockchain technology architecture and smart contracts, security audits are a norm during software deployment. Typically, these audits are timeboxed, meaning auditors have a limited timeframe to detect issues. Should they identify potential vulnerabilities beyond their given scope, the onus falls on the client to decide on further audit cycles. Quality assurance in Web3 isn’t just crucial, it’s cost-effective. Last but not least, robust Web3 QA/QC practices creates a favorable environment for auditors to focus on detecting more complex vulnerabilities, yielding more reliable audit outcomes. So beyond its cost-effectiveness, Web3 QA is also risk-effective. By catching issues early, businesses can save significantly on expensive security audits, development, and technical debt.
In conclusion, the importance of Quality Assurance QA/QC in the cryptocurrency and blockchain space cannot be overstated. It serves as a critical safeguard against potential vulnerabilities and breaches, ultimately safeguarding both businesses and investors in the rapidly evolving landscape of digital finance.
