Our developers have been hard at work in order to restore the Qubit service. We would like to share some updates with regard to our next steps. This will hopefully be the start of a new phase for the protocol and the community.

1) The Qubit Locker Contract was upgraded on February 17th KST.

The new QBT locker is much more simplified than the previous one. Users can only either deposit or withdraw their QBT tokens to the locker.

Boosted rewards calculation will be simplified.

• No lockup period
• Users can deposit / withdraw QBT at anytime.
• Deposited users will earn Qubit protocol fees (10% to 20% of the repayer’s interest). Protocol fees will be drawn from new markets. — see #2.

2) The new Qubit markets will be opened on February 22nd KST.

• Contract addresses will be updated.
• New markets will initially start with zero liquidity.

3) Qubit compensation

Qubit compensation will begin on February 22nd. We will post another article on how to claim, along with additional details.

Notes:

• Some users supplied their assets between the time of the exploit and the Qubit contract upgrade. The values on the Damage Report calculated with this factored in.
• There is a token price gap between the exploit and the Qubit contract upgrade. so the compensation amount of each user can increase or decrease.
• Some users who already withdrew their assets before the Qubit contract upgrade are excluded from the victim list.
• Updated amount of damage: $88.6M > $90.8M
• Updated number of victims: 5,616 > 5601

4) Qubit on Klaytn

Because of the current situation, we’ve decided to focus on BSC and unfortunately, we’ll be ending support for Qubit on the Klaytn network in approximately one month. Users who supplied or borrowed assets must redeem their assets within that time.

We appreciate your support and look forward to making the updates necessary to move forward!

Qubit. Lend to ascend, borrow for tomorrow.

https://qbt.fi/

https://docs.qbt.fi/

Qubit Official Channels

Twitter: https://twitter.com/QubitFin

Telegram: https://t.me/QubitFinOfficial

Discord:

https://discord.gg/JGJBWRxX2Y

Our Actions

We and a group of security specialists, blockchain network partners, and crypto exchange contacts are continuing to monitor the exploiter address (and other related addresses) for any transaction activity.

We have filed reports with law enforcement agencies in several countries. With these combined efforts we hope to recover funds lost and bring the perpetrator to justice.

The team was advised to handle the progress confidentially and not to announce it publicly until the exploiter took further action. However today, the exploiter moved some of the funds to the mixing protocol, Tornado. Therefore, the team now regards these transactions as an indication that the exploiter has made a decision.

New Bounty Program

Team Mound is officially announcing a bounty program for anyone who provides key information that leads to the identification and apprehension of the exploiter. Anyone can communicate with us via tox.chat which provides complete anonymity for users.

• Maximum bounty: $500k
• Reporting channel: https://tox.chat/
• Tox ID: 1D50AF2244549A99AB06D7A4D45E0A0C8B5CECAA4F7F9F287AFFFCA49A0C007F0461D6C8B76F

Our Compensation Plan

1. Team Mound will give up all of its tokens to compensate the community.
2. Team Mound is also assuming substantial debt in order to generate compensation for the community. We are targeting the first tranche of at least $10M to be invested by an asset management team to generate compensation returns and will continue to on-ramp additional tranches of loans as soon as possible. We will publish more details about the mechanics as soon as we have finished closing the first tranche, hopefully within the week.
3. Team Mound continues to work on further compensation mechanisms to accelerate our compensation of the community. We hope to be able to announce further mechanisms soon.
4. Team Mound and our partners are committed to relentlessly tracking the exploiter and any activity of the exploiter will be continuously monitored. If any amount of the fund is recovered, it will be distributed to the victims right away.

This tragic event has been followed by similar attacks on other DeFi protocols and services. For some of these other occurrences, the protocols were backed by major corporations or other financial interests and were able to regroup quickly. Qubit is an independent venture and enjoys no such backing, but we are serious and committed to developing a plan to compensate our community and continue to build in their best interest. As we move forward, our responsibility to alleviate the damage done to the community will always be top of mind.

Your continued patience is greatly appreciated as we work through the next steps for Qubit.

• The exploiter swapped all of the assets for ETH.
• All the funds are now in one wallet(0xd01ae1a708614948b2b5e0b7ab5be6afa01325c7).

Timeline

1. Jan-31–2022 09:34:14 PM +UTC, The exploiter moves funds to a new BSC wallet
   - From address : 0xE56d461F957bB0e81AB6d1c15926Cd9653Aa6333
   - New address : 0xE47044A84047A9540956DB668E97D2336B01D006
   - Refer to the Transaction [1] at the end of this report
2. Jan-31–2022 09:35:58 PM +UTC, The exploiter swaps some funds from the new wallet to USDC via PancakeSwap and Ellipsis and then transfers to the celer network
   - Transaction ID[2–8]
3. Jan-31–2022 09:42:28 PM +UTC, The exploiter transfers more funds to the wallet created in 1), then uses PancakeSwap to convert BNB to ETH, USDT, USDC, and then transfers it to the celer network
   - Transaction ID [9–26]
   - Failed Transaction ID [16]
4. Jan-31–2022 10:07:22 PM +UTC, The exploiter moves more funds, swaps them for USDT and ETH, and sends them to the celer network.
   - Transaction ID [27–34]
5. Jan-31–2022 10:13:16 PM +UTC, The exploiter converts all remaining funds into BUSD using PancakeSwap and transfers them to Synapse Bridge Zap.
   - Transaction ID [35–52]
6. Jan-31–2022 10:18:14 PM +UTC, In the Ethereum network, the exploiter converts all USDC and USDT received through the bridge into ETH using Curve SynthSwap and then transfers them to the original wallet.
   - Transaction ID [53–69]
   - Failed Transaction ID [54,59]
7. All stolen assets are converted into ETH and stored in the wallet of the Ethereum
   - ETH wallet : 0xd01ae1a708614948b2b5e0b7ab5be6afa01325c7
   - 29,724 ETH

Transactions

[1] https://bscscan.com/tx/0x31639bbc953b62394222b2cfc5c50f666e6837722ec4ad1503c468962b869816

[2] https://bscscan.com/tx/0x6c5ea382a45786998389095a3829277f5d155733025994cd5b5a545ed74bd377

[3] https://bscscan.com/tx/0xeba019b2657c495e1b6295ea2ac12263b5ed367b9eacd5db0834ad62dad9fb73

[4] https://bscscan.com/tx/0xb00dea7ccdd5463bcf429085f41b779539c81f0c5e1b16fdb56730571e252f1d

[5] https://bscscan.com/tx/0x5db5f5e6e066bfb80b9031a4f630d953b7d906a90595dd82fe6ff0f9f4088cb9

[6] https://bscscan.com/tx/0x730ca2cbae1444e7b4bc6ade8fa18328a91901287339f5387375469ed08ca863

[7] https://bscscan.com/tx/0x6712f2256e180a440621099196a7956ec02042771532efae3f7082174d04afcb

[8] https://bscscan.com/tx/0x8e9cb90eac31b16f1c87a74cca7627048b99c24dc6b5cd5f60a2ac5174f40794

[9] https://bscscan.com/tx/0x65a9063b5837f397f86e1ea18221cd866e8afb149fa3fe9e9791df95d581d755

[10] https://bscscan.com/tx/0x29c7d84f1bdca852eb730bdc4689b02e7d2ab9d99b4239cb8d2bd570c4c04055

[11] https://bscscan.com/tx/0xed9e6921fa7703e402038a54028b8a9c7f146f4320a39fd84323b27b3e764669

[12] https://bscscan.com/tx/0x14058bcf1675925defd889cd81c8ec451d65e4480eb6ef2e1f534d4e7f245347

[13] https://bscscan.com/tx/0xe428ebdf84c194a3d3578a3425f1c0dba5c5dd2411edce8659874a39195bf60a

[14] https://bscscan.com/tx/0x3d1eeef92ef92c47cfd87980875a9a085d1ed47c36d6112efb978f8d476f31a8

[15] https://bscscan.com/tx/0xd5bbba532e69d6fbe39166068381269469aca93baa76972ab101b54b2c049c32

[16] https://bscscan.com/tx/0xab7ef67cfebcf4138571c9d9c6b4b90a812d9ff484cc7a1630a86a01973becf0

[17] https://bscscan.com/tx/0x26e25a33254e2c20ac6c68f2c75cec2e780b5f1e8125a70b93107bd47585ab08

[18] https://bscscan.com/tx/0xe69adcd8c22a81780192ad939443252e00613382f7f48bfaed1efda83f3d7444

[19] https://bscscan.com/tx/0xb3b37205d2e682053f40f765f2b83c8d95e536b1299c763da6ff8a02e99151e2

[20] https://bscscan.com/tx/0x90660ad3c645be57362788cb32f85080d8abfbbdf08ea511efb283568c6f4207

[21] https://bscscan.com/tx/0xd3c2a0442c81bbdea495c2eaab5b938df602f0c7e3529762b6e6042e0c5313e2

[22] https://bscscan.com/tx/0x28a66d131b2985eaabd5378e083f163fdf6cb8765127dbf88201d80dba7d84e6

[23] https://bscscan.com/tx/0xb6a9107540ba9f41e50cbf4134a8c66b71b577cb96c8f5499958d2b260131b9d

[24] https://bscscan.com/tx/0xf98514149c178ea1f6c84aa347e9697f127f4383d6ded98d70de69abff6df60d

[25] https://bscscan.com/tx/0x7196ffcdb2794c0953a8d898dc5fb0e75486c03ed4e1fb2e6220fd212f07e88f

[26] https://bscscan.com/tx/0xbe554da674dca9bb989b5c9e867a801662ae5b28895b7b5672176f809577f0af

[27] https://bscscan.com/tx/0xd9840b38839e3db9dae7437c81dc69727008b1494ce9ec1156c56bc005fcf7f2

[28] https://bscscan.com/tx/0x51dbfd627d1df0171e6fdf9a77a7c698cfe6f41127e0927d33bd7fc34b761ba7

[29] https://bscscan.com/tx/0xa2529fec627468d4570824fcbb169f705c162af93db68b7677d96e3ed0a40c2c

[30] https://bscscan.com/tx/0x2da739509b6bf6a82bf82dd9513ea8b58736f121929b52c7ee7ed07f1f114bc9

[31] https://bscscan.com/tx/0x70e5523ac5ae7d3bd1caaa62f913894a7c7efba712a0b1b47664fff2ef167d19

[32] https://bscscan.com/tx/0x60f9af289a74af5aabde5c12337beaa1083b82187fe94acac0899ba36186dd53

[33] https://bscscan.com/tx/0x50c2bfd95edfcf4fcd49f1457460420919338bad3b7a2da680bf7d60ad90f982

[34] https://bscscan.com/tx/0x89f548b5ff8e8d40e8f834771ce2be67c823d256301636beb268029390857bc4

[35] https://bscscan.com/tx/0x441146542b3b6189567d8df9575c2859cdde062b72a0590938c4c400bd35d789

[36] https://bscscan.com/tx/0x763c848138233e938afa89a3626c09df1c9d3044bc67e877022b2b6d9bf20854

[37] https://bscscan.com/tx/0xd11040b81ba22dd79c784734008b45a1567011a820c80785f2e6ff3d4a7a8015

[38] https://bscscan.com/tx/0x7c775add4e49f617a6a0bde77e8e90ad0cde1077bdacb9cce66f5c1259a248bb

[39] https://bscscan.com/tx/0xa72017ad55bdf7657322a7920f5a3a9f2e909698e7ead11678bfa95d95a985b0

[40] https://bscscan.com/tx/0xbc230348edbd5034537bc1d28d427c795b35b8347d4f6db37dd4192d3713a826

[41] https://bscscan.com/tx/0xaeb35d18c9ad9a8283bed7dba4ac15614cf2aca5e75932988a382ebe5f49ac38

[42] https://bscscan.com/tx/0x6dce11034f9c5120341d8a01ec3f394694830d2e84f0b4dc5dea84b10b5846fd

[43] https://bscscan.com/tx/0x85db54e1f42ca282c34448272fd08e2fe707f9ee999194be11d0667c7a44b80e

[44] https://bscscan.com/tx/0x3c1c46e6e5eba254ea5f0c65b5c4c6beda4770d72f6ba57070baa129e33f4a1e

[45] https://bscscan.com/tx/0x6f2dc3bfca20bc512de3d676abcbc2c64c2788ecb97052536e7606b3dc068748

[46] https://bscscan.com/tx/0x9db89df4daba67124dd6000ac6aa6f9d935c47bb9a14cff343bc6c6512e8c131

[47] https://bscscan.com/tx/0xb23b6648fb79f87e1618392ca0f69fec481e5e3e6dc37134c3079b4c7e92b02d

[48] https://bscscan.com/tx/0x04be84bf584242c0e416ed1aa9b201a6fc544383bbd623aab8e99e598cef0624

[49] https://bscscan.com/tx/0x374185896772e30b029e06cd57b6d02374c4b2facfc9350427faabfd013d967a

[50] https://bscscan.com/tx/0xf4c284bd716b71816c745e9ebaab85238531ddf3f5ba803d74389229bda09e1b

[51] https://bscscan.com/tx/0xa02b940178143374678368f453e20fd8ee6b87b86a8a4a17e87db21536535693

[52] https://bscscan.com/tx/0xdb6b1aa342f31f474ff1fdee942ad3748b136e48ed43c76cdb5496f9d670cf99

[53] https://etherscan.io/tx/0x240286f6a566a58615ab9e9134ad2f84eb3756988c32fc0bf99879ebb2427bae

[54] https://etherscan.io/tx/0xd11b0d9048e29a2a94e05a06f71312793869d2ad6fbc4aeeb49818ffc752684f

[55] https://etherscan.io/tx/0x0c3a1ca345ead5193ac4a89df45af06610a9c71fa4cd064227e693f6e4d4a86b

[56] https://etherscan.io/tx/0x61c64f4c104abe3de577f7cb640d6d423e3d3a4ba51bb7e22774b9605b883406

[57] https://etherscan.io/tx/0x89d29e051a2c3a51acdc43e74b31f9cd32b34866dd838dfc41845382aaf3024a

[58] https://etherscan.io/tx/0xcd533c65441e888222e35183b6dfc7cf721d8db1954c3301fa35cdf43c3ef0a2

[59] https://etherscan.io/tx/0x162b6a205c0d3504f8bc45aab30ac2ae55f6b7ed085d5655d994454370d98da6

[60] https://etherscan.io/tx/0x12239765a23ebe10bd2f339ce2719e32747ee5366a90818ef8497355139faaf2

[61] https://etherscan.io/tx/0xce39911c4953715009c2ae754dcd36d859b97d8cbfbb758f79236b6050b4cde3

[62] https://etherscan.io/tx/0x58f1b50794e331a6343abf90dec75797950a19264c3cc669113ccce03bc22341

[63] https://etherscan.io/tx/0xf7450037e8c42a0df633ceb3aa6de36597fd7d0f4772fb2bb920796a8cd1a400

[64] https://etherscan.io/tx/0xc58af59a05ca09e1513b9d7c0edfc15d0d30a95933d06b4cb3307f566e71df22

[65] https://etherscan.io/tx/0x4f0a9aa8431c632371f0381ae31dfdbd68a859d29e3c8c2ce3d844bdf9bbd94d

[66] https://etherscan.io/tx/0xf7b331dfc7b55603156e6b066c5a53c35f1ee8c4a18a689878a5b81c3ff8f632

[67] https://etherscan.io/tx/0xbbd188b8945ac77f10988332ebf3c7e4c4fc166b4f17398758bc91834fbfeaa2

[68] https://etherscan.io/tx/0x1feabdf7290cdf79effdf542d1ff40e06155d4d7e538a5b99a615319fcb522d1

[69] https://etherscan.io/tx/0x088308a07130d13941e128700e7b95b772538afcd3c517a4af0262dba0d630ce

• All of the funds are still on-chain and they are monitored by the team and our partners.
• The team working with all of the centralized exchanges to block the transfer of funds off-chain and to identify the exploiter if the attempt is made

Timeline

Immediately after the incident, the Qubit Finance team stopped operating the service, and now the team is tracking the exploiter’s activities through cooperation with a security company.

1. Jan-27–2022 09:18:55 PM +UTC, 0.8887725 ETH sent from tornado to attacker account
   Refer to the transactions [1] at the end of this report
2. Jan-27–2022 09:19:41 PM +UTC, Attacker sent transaction (‘Deposit ETH’) to secure the BNB funds needed for the attack
   - Transaction ID [2,3]
3. Jan-27–2022 09:34:01 PM +UTC, The exploiter calls the ‘Deposit’ function 16 times, where the logic bug exists, and creates xETH in bulk on the BSC without depositing ETH on the Ethereum network
   - Transaction ID [4–9]
4. Jan-27–2022 09:37:44 PM +UTC, The exploiter withdraws all assets in BSC Qubit Finance using the xETH created in step 4 as collateral
   - Transaction ID [20–39]
5. One transaction is failed
   - Transaction ID [36]
6. Jan-27–2022 09:54:47 PM +UTC, The exploiter withdraws a portion of xETH as ETH on the Ethereum network
   - Transaction ID [40,41,42]
7. Jan-27–2022 09:57:08 PM +UTC, The exploiter uses Pancakeswap to swap stolen assets into BNB
   - Transaction ID [43–80]
8. Some transactions are failed
   - Transaction ID [60,68]
9. Jan-28–2022 02:26:07 AM +UTC, Qubit deployer send messages to the exploiter
   - Transaction ID [81]
10. Jan-28–2022 08:42:29 PM +UTC, The exploiter uses PancakeSwap and Ellipsis to convert BNB into USDC, USDT, and ETH and send them to the celer bridge.
    - Transaction ID [82–86, 88–117]
11. Jan-28–2022 08:53:11 PM +UTC, The exploiter replies to the Qubit deployer with a Twitter link.
    - Transaction ID [87]
    - Twit link: https://twitter.com/tonycoxphoto/status/1486912028300091406
12. Jan-28–2022 08:59:29 PM +UTC, The exploiter uses curves in Ethereum to convert all assets into ETH.
    - Ethereum Transaction ID [118–131]
13. Jan-29–2022 02:14:56 PM +UTC, The exploiter transfers 50000 BNB to a new wallet, converts it to USDC in the new wallet, and transfers it to the celer bridge.
    - New wallet address : 0x21bcb4Fa299E13c4fA97b2271099f35a1499e74C
    - Transaction ID [132–137]
14. Jan-29–2022 02:19:32 PM +UTC, Some BNB are exchanged for ETH, then transferred to another wallet and transferred to celer bridge.
    - New wallet address : 0x78BDcd73DCaA0467Bcb9e4a3EFefB3f05f80A66a
    - Transaction ID [138,139,140,141,142]
15. Jan-29–2022 02:39:55 PM +UTC, Some assets(ETH,USDC) are transferred to a new wallet and transferred to celer bridge.
    - New wallet address : 0x5e78545287Dec41c5a12E3a9dE125f07Fa4907Eb
    - Transactions which move assets to a new address[143–146]
16. Jan-29–2022 03:44:06 PM +UTC, Some assets are transferred to a new wallet. After exchanging in the form of USDT, USDC, ETH in pancakeswap, it is transferred to the celer bridge.
    - New wallet address : 0xE56d461F957bB0e81AB6d1c15926Cd9653Aa6333
    - Transactions that move assets to a new address[147–150]
    14,652 BNB left in this wallet
17. Jan-29–2022 04:45:53 PM +UTC, The exploiter sends a transaction to himself and leaves a message
    - Transaction ID[151]
    - Message content : A mi amigo: los picoletos no pueden hacer nada. ¡Viva Cataluña!
18. Jan-29–2022 03:26:44 PM +UTC, In Ethereum network, the exploiter transmits about 1000 ETH received from the Celer Bridge to his original address
    - Ethereum Transaction ID[153]
    - From address : 0x78bdcd73dcaa0467bcb9e4a3efefb3f05f80a66a
    - To address : 0xd01ae1a708614948b2b5e0b7ab5be6afa01325c7
19. Jan-29–2022 03:27:15 PM +UTC, In Ethereum network, the exploiter transmits about 3million of USDC received from the Celer bridge to another address
    - Ethereum Transaction ID[154]
    - From address: 0x21bcb4Fa299E13c4fA97b2271099f35a1499e74C
    - To address: 0x5e78545287Dec41c5a12E3a9dE125f07Fa4907Eb
20. Jan-29–2022 03:30:37 PM +UTC, In Ethereum network, the exploiter transfers the assets received from the celer bridge to the original address after converting them to ETH through the curve
    - Ethereum Transaction ID[155–161]
    - From address: 0x5e78545287Dec41c5a12E3a9dE125f07Fa4907Eb
    - To address: 0xd01ae1a708614948b2b5e0b7ab5be6afa01325c7
21. Jan-29–2022 04:01:57 PM +UTC, In Ethereum network, the exploiter exchanges USDT and USDC received through the bridge for ETH using uniswap and sends it to his original wallet.
    - Ethereum Transaction ID[162–172]
    - Failed Transaction ID[167]
    - From address : 0xE56d461F957bB0e81AB6d1c15926Cd9653Aa6333
    - To address: 0xd01ae1a708614948b2b5e0b7ab5be6afa01325c7
22. Jan-30–2022 07:48:14 AM +UTC, Qubit deployer send messages to the exploiter
    - Transaction ID[152]
23. Jan-31–2022. All stolen assets are converted into ETH and BNB and stored in the wallets of the Ethereum and BSC networks. All assets are in the wallets below.
    - BSC wallet : 0xd01ae1a708614948b2b5e0b7ab5be6afa01325c7
    69,593 BNB
    - BSC wallet : 0xE56d461F957bB0e81AB6d1c15926Cd9653Aa6333
    14,652 BNB
    - ETH wallet : 0xd01ae1a708614948b2b5e0b7ab5be6afa01325c7
    18,253 ETH

Transactions

[1] https://etherscan.io/tx/0x8d2e9fd13c3e3f59eac17ff55bb0a0b10eee965a2e768e60832b1b3d5b80ebfb

[2] https://etherscan.io/tx/0x7f537463d055f32b49050a7e2179461666a9494deb7045d7825d72c210168298

[3] https://etherscan.io/tx/0xff6fa990d4f6cf85592f7fb32840539e6dad20fda4e547acb1a4bbb969d99ba9

[4] https://etherscan.io/tx/0xac7292e7d0ec8ebe1c94203d190874b2aab30592327b6cc875d00f18de6f3133

[5] https://etherscan.io/tx/0xc7e964fa3b0e8d2df6d92d96e57d7eb6cebf7ca581807cab96d4f3aafa98ba12

[6] https://etherscan.io/tx/0x006a8a6e58e26384aa7dd7951d57f51136049601a772a40fcde34722191ed3f8

[7] https://etherscan.io/tx/0x6f24d176e178f80e15daa4a2c03106404584be6469a29077defd2c9e788e58c4

[8] https://etherscan.io/tx/0xf56fe06b0e7af7ef393fe0fa15aa173891940f800c3ac14db7a81c62ebad9663

[9] https://etherscan.io/tx/0xb9c5e0ed27bbb5237a6fa4549784ba740059253f57453a8c4cf1f80f71b09cf5

[10] https://etherscan.io/tx/0x478d83f2ad909c64a9a3d807b3d8399bb67a997f9721fc5580ae2c51fab92acf

[11] https://etherscan.io/tx/0xd0d86c51770877c80edb018d2c69ed23ca834694e3ca43159a9b9b889ac4ad4d

[12] https://etherscan.io/tx/0xeb9f622e54253b3fa14dcee243bc9345a8fbc562168e973093ffc86d7f8a5829

[13] https://etherscan.io/tx/0xbdedb13d78bcb2f4eb48241c0ed0b299264458021d6e8f331e08a1c9bd96f943

[14] https://etherscan.io/tx/0x940315691510a8f6b2690d3df4608ae1dd710c665bc76e40954fa8092a5fc541

[15] https://etherscan.io/tx/0xa6282e604eab18390be3abf2f4f0039dbdbcc3f4cf15e4d3ade296b8684a0486

[16] https://etherscan.io/tx/0x501f8541dc7cc594cd0ee245c8710ca12084529b596a3fc0d702f4a77f70b848

[17] https://etherscan.io/tx/0x580206541ab2916d2ef9b89e5bf6e833031700d01f2ea372ec0bec331f38225b

[18] https://etherscan.io/tx/0x3dfa33b5c6150bf3d64f49cb97eba351f99e4dff7119ef458e40f51160bf77ec

[19] https://etherscan.io/tx/0x9cf9e457aade4a0421eb188cfb5d17694c614c139b1fa0122930d5df27228349

[20] https://bscscan.com/tx/0xcfa4379af6fb1da547ae7270485b63f304b1fbec55f2a0c1ccf0a4f59d839b2e

[21] https://bscscan.com/tx/0xa39e732332604f70180ae8107b1a9315e8f7cc7f6108f3235bdb46867b40bd7a

[22] https://bscscan.com/tx/0xeed6cb886729d654cbb192d9e5a749f6e176ced130cbaecb5a656ac4164259db

[23] https://bscscan.com/tx/0x4c32d6b8da9be2471a52b921c198b4188f784f12f46557a06753eecd8340aa47

[24] https://bscscan.com/tx/0x103d3be5194a9ba62a9539532511c9a16e320580726a113476ae589c0ed0e452

[25] https://bscscan.com/tx/0x4d13ebfed4694de569dd64516306090d26193442c0807fb5c937158653dfc0d0

[26] https://bscscan.com/tx/0x0294daab79affea4a829be01bae1f6d4216c3124e90b54fd23c5bb8a124002d9

[27] https://bscscan.com/tx/0xc55995dbb50194b216070cd404f13470b12cf3ea424ab5e93c6d0bd8c8b0fb3d

[28] https://bscscan.com/tx/0x1786147bc75cbc839637d851ea610caefd41c610c6bcb07f9b0c598047208462

[29] https://bscscan.com/tx/0xca572ac9a35d33fd52c8146976e680ad0ca2329d77a922c68ad8771de6af3128

[30] https://bscscan.com/tx/0x405dde974a63eb5b8261b46fae3f60a5751a36e73d91a231f830e6dd0825dc74

[31] https://bscscan.com/tx/0x4727bdf39286e2b2cb006c1982e6e0ceebd502c5fabecc18770e52fda5f3d618

[32] https://bscscan.com/tx/0xfb3ea29f899c30d94a51d936f5cf847d155bdcdca0ca5953f1bfe9822b7d9687

[33] https://bscscan.com/tx/0x3844a9eb0bb5bc0518c6088e5a97f067100da69b47d8a3661f4a340335f3791f

[34] https://bscscan.com/tx/0x1778f88ae394dc7b41a58cb2a2b2ed72a3fa917c2ec6f9a13eb9b618b268db64

[35] https://bscscan.com/tx/0xc13841508a32667b1803ab7901252e952fcc06e2f157c7371fa83600358b5397

[36] https://bscscan.com/tx/0xe9ebf039d630212e55667cf52c3014356982efc0e163a637677829940fc6526b

[37] https://bscscan.com/tx/0xe14d35f1295a3f6316e5c032c89c814a3ffd217e957a1abbfde5d7a8c2903551

[38] https://bscscan.com/tx/0xcc8bd8c27da0c965676ae15161a1e0574998d71a10f728394d87ad1e0628acf0

[39] https://bscscan.com/tx/0x70e34269e709203f47ec05e92ac59c96d980a41608d6a101ac991f19e9eb33fa
[40] https://bscscan.com/tx/0x715f5c59015bd44759738fda20cda6995e95123df16659717e3f97d0adddc3ef

[41] https://bscscan.com/tx/0xfbe06b1bb53af215dff778f15ebe88fa8518edc9a44c43f368042e793a768039

[42] https://bscscan.com/tx/0x974410d882893bac9547f044563850549c6ddb66335efe1f7364c782b88d8e1b

[43] https://bscscan.com/tx/0xf8f4e781f0f43f2fe12638972d169bec8222ec4958419a37bdc7dd00ece11be0

[44] https://bscscan.com/tx/0xbfe974c3adbb7252cd893a91a5f65fde2bd1358bdf8e7dca3ee197855d616862

[45] https://bscscan.com/tx/0xd89e8e5a2ab8f4e00ab98f128352c4352d8f17a4a3a2239bec3cc689d0cb60e0

[46] https://bscscan.com/tx/0xc2b464c7677f8c5283c63ec1c0eef9829f16647f82ec870248045dd987a42ad6

[47] https://bscscan.com/tx/0xf542f64e8db64bbb6ccde96f8f6e8f44f1f397db1917859d4426a78862edc78c

[48] https://bscscan.com/tx/0x75d05f7390f4175400df63c2a5f2e1b5c3cfc87252a9e43ea9fb27ca211fafe9

[49] https://bscscan.com/tx/0x5438f2aa81d87683798c426a207b5d3cb5f56e1e031e347e69282c2d73b18095

[50] https://bscscan.com/tx/0x5ae62086e94abf8bde4b1a8a27669a5ffbff017fa297f8435954b738dc0052b5

[51] https://bscscan.com/tx/0x8de97c859e5a5f1f61c3d6a6babed280d997fd593a5967cd996dd6af458da6e3

[52] https://bscscan.com/tx/0xd7b9f8719445c1e847ad9a9247209036e52bfa5400466784631a761dd8df69c5

[53] https://bscscan.com/tx/0xdaa7569d77ae9fe08dec536953963aff48d5ef314132a8b1124213712e826fdf

[54] https://bscscan.com/tx/0xaa1e1852fd685b382111c59891391f2914620a8f63ad042ec5d8e81318403857

[55] https://bscscan.com/tx/0x82834b2690fce942d644599122af9dc72f671ccc790e2bf61ab01e7c56e43684

[56] https://bscscan.com/tx/0xbf46759e163b473898d17540f69aa4160c31abd11c38ebe912e558710e788c2b

[57] https://bscscan.com/tx/0x3a19a9086a9e7190339b238d84736f94e63f4bccced34e99bb0dd93b29fa2786

[58] https://bscscan.com/tx/0x62e43314c48be97d4a54416a76e8c5a557813cded342a06910a18b26ec782db7

[59] https://bscscan.com/tx/0xdbd5b4373f2cbc5e046fe3033b444ba23e59f418ebc417cfd84a123b7214ee85

[60] https://bscscan.com/tx/0xd5b0a7b96ced342405c67f9fa35ff898b2cd63b99a811ad53060dec619f7e186

[61] https://bscscan.com/tx/0x2ab6ed7b5d787dda5612f49cf93b83cf9ec3cb2dc5dc43183af0aabf2fecd1a5

[62] https://bscscan.com/tx/0xa3660c9cdfc36dd8ea8f32748e7b729ebbd82400aa0095e0706c0a2b78e97a35

[63] https://bscscan.com/tx/0x8a402e9e21265f25f6de82a524abacb6c4caebd0af96e5f91fca6f9d2cf8e9ff

[64] https://bscscan.com/tx/0x19caa4afe7015625280e6ca0245b7ce75f5f480996b55e891a48dbcc3acd27cf

[65] https://bscscan.com/tx/0x031b4597563cda357cd5b7f7cb8985902b313fe8ab2b7eb49149737eb037972d

[66] https://bscscan.com/tx/0xa8c814bb80930b8280dc60179ce2f908987f9a0f5cc6f9042925e8ddbe1da328

[67] https://bscscan.com/tx/0x5dbe20518d5e7575c5c3f2545ee4af7d1ec2ec7d8ffacffb0988562aad4e96ee

[68] https://bscscan.com/tx/0x2b3b16885903c3af1946193536b1b108bffc84a5f8af7207e23f696397e8fd7d

[69] https://bscscan.com/tx/0x9da510af754893d9b35a262b3f4933b27528cb8ad0799229779e326be44e232d

[70] https://bscscan.com/tx/0xb439936af450c3dd698c2f98f8111a3a93313ccdd2e25283227e7f02584b8a46

[71] https://bscscan.com/tx/0xf71162ae361605c3ad052b190a9ae5770d3adf752b397e1bc7e20708005c2236

[72] https://bscscan.com/tx/0xf2fd2be510972c4549f2a17b6ad3bebc272da7f82ffcba45af08e8c7901c28a5

[73] https://bscscan.com/tx/0x522d36af4ef05148c10da95bb8e00dd592d3523519cd7f70610b91c402a702f7

[74] https://bscscan.com/tx/0xc9b7801e3bfd687dd17d011138d33759415921cd6bd7b4787a64913bac59158b

[75] https://bscscan.com/tx/0x35d7d28787e4a520d0718be1272183159ba64b8be6867b1aed20dffdb2a4bc30

[76] https://bscscan.com/tx/0x4019fdc2cf4eca2d447eda183dbcbb1851ddd853c9d21e917fca556e441014e6

[77] https://bscscan.com/tx/0x15fae101054c2e2d65b354a6ceec22081c1d705859709d4642777c45c80a76d4

[78] https://bscscan.com/tx/0x93f257604d4c7cf1742267214a6ed8db896f3f96b937e6c4e1243131f9dfa0fc

[79] https://bscscan.com/tx/0xf20a1c3cc6fc82132bbc4281104c1559e6e80181aa2e982fae5765bad217b575

[80] https://bscscan.com/tx/0xfa335177c3abbf0341f32bdd09df7ee372a3f409c9e69100a78db2f74cfcc807

[81] https://bscscan.com/tx/0xb7a948b206acd0885aab382287b964bc92c4a687b185b65a41c4573a414f788b

[82] https://bscscan.com/tx/0x8fb8e297bd83ab982a3fc0228386556fee0ad69fefaca037880eb45f403d2684

[83] https://bscscan.com/tx/0x10028389342d183a2a070e7876eaec31d7c1ad8b644606477a7249f2b1739961

[84] https://bscscan.com/tx/0x49527e542363b7b1a146e9388c7f2fd4f20bd5a08c0406c659d8d0223ac7a98d

[85] https://bscscan.com/tx/0x98f5bee2fdf52185dc62088993d64dd9256431f097462bcbaea3ffd7af2eaf52

[86] https://bscscan.com/tx/0xd65c6578ce7f657acb361b068e6a9fff8ed096d4c4b2d65cbedf7f309a294f4f

[87] https://bscscan.com/tx/0xb52ad0b5ff2de5eb04ad549012c067c34b21ff0f7960939db0484262b882c877

[88] https://bscscan.com/tx/0x5edda1efafa800aef14af80316041fdebf505d95791df0e56fe94c8da1dffb02

[89] https://bscscan.com/tx/0x327d8f6bcbc13f2e1f6d274f5f9b099313fdaf43e55ae493187e5e4f8d040775

[90] https://bscscan.com/tx/0xdf0d223773fdfde1fa3d72c152ce93629e24328bc9069ff7e5890cb19aa3639b

[91] https://bscscan.com/tx/0x18dffce08e7bd500b97112db812fa7916062ebc11f97f3936e04fc7a41a001ca

[92] https://bscscan.com/tx/0x0744f03f5d816024ca3cc14013d7a9f2b3a332e94c402eddca476fdcdda5cf42

[93] https://bscscan.com/tx/0xf31f097ed3a60281fa24fab34c558128cdf5c2cd872570aba9b2c20f7224005b

[94] https://bscscan.com/tx/0x403561921c815da50cfc8cdc30442c84772f69fd215e6f704a4e5db43be590c6

[95] https://bscscan.com/tx/0xd747ccbb12ea36ced45f3269c0d8019091d34786c4978097064c9f665c37dc12

[96] https://bscscan.com/tx/0x614c0df71101c8afc2d719c9173f98ccac1232d5465d386e1a3e09ae6f0d3a79

[97] https://bscscan.com/tx/0x254fcdffb3a838ffe01811438f915e528fb3b0ea0834e5066270cc88a13ebaa9

[98] https://bscscan.com/tx/0x50ee0fe3ffa82bfd79e0cb970d1f1d73d338b328b01d45eb638cacdbdc910f7b

[99] https://bscscan.com/tx/0x2501cbd3450582829ba789b4fef06a5263d031dc161b04187c1aedf0d0bf6b03

[100]https://bscscan.com/tx/0xc620646dcc13d940dc9d086c9159e619fdcc0b17aecd835ad300fe31f51303f0

[101]https://bscscan.com/tx/0x46677ad8ad2a89e39baa20c76db68cc6cf3fcd8ce235d3309edfde0bcb4b24c7

[102]https://bscscan.com/tx/0x716e2d59b5eab463da71b5f890dcd492402fe446cfc1dc545121f3324f4e3008

[103]https://bscscan.com/tx/0xba6039a29662ff498489458a5fa65906e6814ce73304152fb434481c1772adc6

[104]https://bscscan.com/tx/0x186c51a3181f286ea471f0cf1bb98cc09843976d7bf06f72efae4247bff4c6e5

[105]https://bscscan.com/tx/0x5e2f7685988236a5ef83105436ff4fe520c7890a303b0624cd34b2dca3880e98

[106]https://bscscan.com/tx/0xf59a14f1d4c4c9e3dbb77fd34ed67c5c1168799c9ad905186c454c2168f6f567

[107]https://bscscan.com/tx/0x38a02726907e388aa6db511ecf29f397589d05aa4cb38b306e533fdac492f758

[108]https://bscscan.com/tx/0x6fc55b2770a79ff114d314a7246764c2a6408911bfcbf41108ba6762cb76d6b7

[109]https://bscscan.com/tx/0xa58d42949c1b61a8784cb6b062daadf0420fb46915e857561ebe3f6b2ac47a8b

[110]https://bscscan.com/tx/0x1e4ef27aca1379411483b369a45b7612e76bb04771750e0e3455fd8ed5cb6f55

[111]https://bscscan.com/tx/0xffb9c65e7e83f58cb1c1dfe4eea811e6077d81c12bff0a125ce5f52c9c73749f

[112]https://bscscan.com/tx/0xe1c9ee99e6326e18c8330497b95e7884457523eb8b84a44ac1d116fc85541d72

[113]https://bscscan.com/tx/0x689de77b133fd91377b3d777e72627211cb152da859a0433bd796a01ffb72bba

[114]https://bscscan.com/tx/0xce3b8beb1c185de444d3d1f19a6d006b7027651458e1dd12bfeaf59c8f8d43e4

[115]https://bscscan.com/tx/0x8f103864611d337df375b1d8859b0f57508bd8078435b592ac7c0c6ea3a12795

[116]https://bscscan.com/tx/0x4712a09a548bd772f3255700af46a39d938b699ecf9cb954781897c706f905a0

[117]https://bscscan.com/tx/0x30cf47c97906d0262210f4e4e3e8fefe8b9dcb5228de1c9c1d94696cfd92bc18

[118]https://etherscan.io/tx/0xdb501b5a3af9093f2124f1988dc239988bf62f585e861f8a6b28a4bb61cd01cc

[119]https://etherscan.io/tx/0x3f09db54bc20295f7fba1e4779022784fc196b803b9401a21510e088a0b944b3

[120]https://etherscan.io/tx/0x7649430de413c7c82d07e0f26671f2b0110963a5cb322fb5db2fb9880e59f05a

[121]https://etherscan.io/tx/0xdd9f24b53c4af9d3c2d982c25cac7a16632cd930d1b7409a01ad5f20c4a84177

[122]https://etherscan.io/tx/0x30b9d1cd99fd25ad98e70223e8faa709fc455334cdfc058697cebaa772e1621c

[123]https://etherscan.io/tx/0x411f3f5caf8963e70651e4b55ae48066aa149eaf6548c9954c618152c0902f35

[124]https://etherscan.io/tx/0xe7a659d0cde3e95232f6c4c2047d637b3963f9023154b56fe88cff4fbce61333

[125]https://etherscan.io/tx/0xcd1dbbfcd386157d78002e012a5b8378b024440c8f385a5edb135e2713eae02c

[126]https://etherscan.io/tx/0xcf0b482fea94437f65e202b9b6af34cc363d70c63053b96db02269e3716a6651

[127]https://etherscan.io/tx/0x51abb661f2b930cc123a28201547f8d96c2acff2fa0334a92a552a1e25ee2f23

[128]https://etherscan.io/tx/0xf40bf664e857ab2fedb0f24d66dec2af26266ab685d4c995e4c09a725fb79e41

[129]https://etherscan.io/tx/0x22aae7ef3b30363200938edd5a36c950007e9371f3c0a514272af015178d2697

[130]https://etherscan.io/tx/0x30c1bc3d5d61602d022ac213d21272315a1f44abb15fa4d0873b47eed5bd410b

[131]https://etherscan.io/tx/0xcdd538f1230d32939e6c38c3a67de4b4d0c2f0d99f4254e7b4dc6cdb16724359

[132]https://bscscan.com/tx/0xaac09ec93c495e2069ba29d34c2fa70873d5e800d51333c4d06d7f22a4fdddd5

[133]https://bscscan.com/tx/0xeda38b8b3431d91a98bb29270b556b00506bd5b8bed41c2834625856cec29473

[134]https://bscscan.com/tx/0xfbe83733d762df326d1bea884fad946f72dbd2f8173215e88d06ebceba76b81b

[135]https://bscscan.com/tx/0x06c65ea73ecfc6350075c5303c000d15093a9f28a8632af6ec2be01d4c759bf5

[136]https://bscscan.com/tx/0x40f8e381024892de2a89d13829d4b3ca2be50869588abff63ddc019f6bc3aa47

[137]https://bscscan.com/tx/0xb10de78e23e86b45137aabe9fee60468390e3447c3c131ad9305b99d1185e346

[138]https://bscscan.com/tx/0x1d7b73f357834c3c7e6866b170e58db2fb9b5163e91b6094073b380fd4e540d3

[139]https://bscscan.com/tx/0xec95f3a7993932341c7c326de48dcdb1f8971c1fbddcb74e94bc4432387fc9e6

[140]​​https://bscscan.com/tx/0x93e661332484f85f1ceacd17eeec715facccce91c3e779c4c410aba41213b1ae

[141]https://bscscan.com/tx/0x25feb74bd2c5b3b94e367bcdc89178b5f339a0199707b020da04c5d51c66297b

[142]https://bscscan.com/tx/0x844745944638f6f9bdef0edb513482752050ec9857aa0040bdfe5740faaf6d5e

[143]https://bscscan.com/tx/0x90b90e19accab6f1d692c4029f757699456f3b9c03ce78232aceb77b30c9b91f

[144]https://bscscan.com/tx/0x2f13f782ad07edce7f6cb1b678ee61e6dd3f6073bb4568c2ee1bda4849103485

[145]https://bscscan.com/tx/0x0146b326060addfef8f487edecf492aef08801c2f20e0a9485342eaaaf6873d8

[146]https://bscscan.com/tx/0x5576bb19c58a8a5b0abae54e904291dcdf2d1125635c4d916c1e11e2ee3dfad0

[147]https://bscscan.com/tx/0x2ded54f21d4d7ae77660b4a3ae5c536fa9dc7d5f7419b5d8db22b733923752bf

[148]https://bscscan.com/tx/0xc44e74ada4815fba41121b97ee50261d2751ec2a9908d8f9a0aaa1e4915da347

[149]https://bscscan.com/tx/0xb4e1e7b073109fde403b0b7fb2304a0738981a422762118150d188cd557baf0b

[150]https://bscscan.com/tx/0x9483aae17e85e9a200d66654fa6eba38fabd51e5f8b8e40a8543eb268d6cc14e

[151]https://bscscan.com/tx/0x18cf67650de0cd8bcc752b3b4a225e9c7a3de071ccd2a18da04c3951cedff477

[152]https://bscscan.com/tx/0x53668e01b0180dc52f4a035c5a8111693664582d434eae927752ee4679325406

[153]https://etherscan.io/tx/0x6cd4378b1d1ff4545e987e08c842ed255fe4cba533d8b951a904e0bd55117d2e

[154]https://etherscan.io/tx/0x242aef825d96498b99ddef4a872a84c406f66292b304a1c725e79acaa6d85a04

[155]https://etherscan.io/tx/0x645f022baa29f47a5bc2e5c294f580f42ddbab16a68db77e4a17213a06635ce8

[156]https://etherscan.io/tx/0x0d3d8eb78969d165da62464011640cabfc6eaf3fa4cc59f4eb6df6e4094c9a40

[157]https://etherscan.io/tx/0xf7b081c7ac2d5eb90d1339533198c0fcca1ccf32529e1adc618cc494f4a867f7

[158]https://etherscan.io/tx/0x0eea8f6fc3bc75171436e7fe7e8b3215fdcf6d3d3431ae23a0c6749480a25349

[159]https://etherscan.io/tx/0x1425f0f7e90b97b29bfffe9d3ebcc1255b683d390d55af059caa0d16633adf07

[160]https://etherscan.io/tx/0x4fa26fb1085f6ff7844307dad2e0fa3b76031c7c90e72e32ccc1c76689db4239

[161]https://etherscan.io/tx/0x90f1b5d68aa089c392b486afd6a97b0bf04603639dc4673799762938af4ae25a

[162]https://etherscan.io/tx/0xd63f5e402788ae9b81538a4c7f8341b2bfac4deb56b3d618b442d9a297f73106

[163]https://etherscan.io/tx/0xcce52ffc422d43478b8f8daca5e2b38ccf78744591837f3179eceda2b523f120

[164]https://etherscan.io/tx/0xc4f1835ad925ac7557c59a850146d7599a7ce286eab30b4f9572f6d15bb5e8f7

[165]https://etherscan.io/tx/0x1f27cb37f208bbcdfd3571d9bc644d8801b4a769fcd7adf6d49c1500a1c68e92

[166]https://etherscan.io/tx/0x592bdb06832e1e754d2e249c2e8a5171048b99f10e9f105e5c7fbb186d3909b7

[167]https://etherscan.io/tx/0x2868c3eb61bcac531f33765d9ac9ee652595814f717b7bf8a027b6b3fb8b7fa6

[168]https://etherscan.io/tx/0x2c694e4f552cf7d211c70d5d54700c7fd73891ffb06667a2c61e2130bb10073b

[169]https://etherscan.io/tx/0xf7d228d3f544a1ba008213135490b80d5c4aa10b90975696e35d68f7236f4836

[170]https://etherscan.io/tx/0x39c811ff5f93fc1c964c6a5643876ae58dccddd5eb5affce3bf8d429aacb8501

[171]https://etherscan.io/tx/0x83c41e69d6d32396ab1c7393ce6c4ae4a56f411d9c078f820011444a170a4e0b

[172]https://etherscan.io/tx/0x5c63e09f112acdb03966b4ea6b755fce635e96042231522d07433365d280c0d5

Some articles are spreading, which were written based on wrong assumptions and speculations. Therefore, we would like to refute those while explaining the detailed history of Qbridge protocol development.

Timeline

• 23 Nov. 2021: The first deployment of the QBridge contracts on BSC https://bscscan.com/tx/0xdb9ac83db9471d20497dc249912bf80f71ad9fee28b247e3f1d493b36e958373
• 29 Nov. 2021: The first deployment of the QBridge contracts on Ethereum
  https://etherscan.io/tx/0x94aa2b54f6d8a2a62266c1de6b95819d444031dc401de9b89cd71660411f0b28
• 1 Dec. 2021: The Bridge contracts including QBridge, QBridgeHandler, QBridgeDelegator, QBridgeToken, and the relayer were provided to Theori(an Audit firm). Afterward, the team began to develop the interface for Bridge. Also, the team decided to develop the function which allows direct deposit ETH(native token) instead of WETH.
• 13 Dec 2021: Audit was completed
• 13 Dec 2021: Upgrade ‘depositETH’ function
• setResource: https://etherscan.io/tx/0xe3da555d506638bd7b697c0bdf7920be8defc9a175cd35bf72fb10bc77167b66
• QBridge contract upgrade: https://etherscan.io/tx/0xc7617ed8be4f322a427a4181eb6baf7d351b829307594771a63ac716860869d9
• QBridgeHandler contract upgrade: https://etherscan.io/tx/0xd3fe9076228e51b47b7c27d2b9e1ce0b88f7be2a22236a621814e7787b089e98
• 14 Dec 2021: Internal review was mainly focused on ‘depositETH’ function and the team did not realize the issue of ‘deposit’ function, unfortunately. It was not in the coverage of the audit performed by Theori.
• 20 Dec 2021: Launch of Bridge
• 28 Jan 2022: The protocol was exploited

[1] The reason why ZeroAddress is set through setResource function is that the executeProposal function is implemented to select a native token or ERC20 token by using the tokenAddress variable. Users can withdraw Ethereum through executeProposal when the tokenAddress is set as EOA address, i.e., Zero address.

else if (tokenAddress == ETH) {

SafeToken.safeTransferETH(recipientAddress, amount.sub(withdrawalFees[resourceID]));

}

It was a fatal mistake as a result, but it was not intentionally set to a malicious value, as someone has mentioned.

[2] If ETH was used instead of WETH (ie, when setResouce was set to ZeroAddress), there was a problem that the existing deposit function worked unintentionally. However, the problem was not recognized during the development process, and the deposit function remained even after the contract was upgraded.

We hope that all well meaning community members will engage with us in our community for factual details as articles that spread falsehood has far reaching damages to the community.

Also, please refer to: https://medium.com/@QubitFin/protocol-exploit-report-305c34540fa3

This report includes an analysis of the attack in its entirety in order to ascertain the nature of the exploit and, to prevent any similar exploits in the future.

Incident Timeline

1. Jan-27–2022 09:18:55 PM +UTC: 0.8887725 ETH sent from tornado to attacker account
2. Jan-27–2022 09:34:01 PM +UTC~Jan-27–2022 09:50:41 PM +UTC : Sent 16 deposit tx to QBridge of Ethereum
3. Jan-27–2022 09:36:32 PM +UTC~Jan-27–2022 09:51:02 PM +UTC : Sent 16 voteProposal tx to QBridge contract of BSC by Qubit Relayer
4. A number of xETH tokens were minted by 16 voteProposal tx, and liquidity in Qubit was withdrawn using this as collateral

Exploit Method

The attacker called the QBridge deposit function on the ethereum network, which calls the deposit function QBridgeHandler.

QBridgeHandler should receive the WETH token, which is the original tokenAddress, and if the person who performed the tx does not have a WETH token, the transfer should not occur.

tokenAddress.safeTransferFrom(depositer, address(this), amount);

In the code above, tokenAddress is 0, so safeTransferFrom didn’t fail and the deposit function ended normally regardless of the amount value.

Additionally, tokenAddress was the WETH address before depositETH was added, but as depositETH is added, it is replaced with the zero address that is the tokenAddress of ETH.

In summary, the deposit function was a function that should not be used after depositETH was newly developed, but it remained in the contract.

Actions taken

1. The team is continuing to track the exploiter and monitor affected assets.
2. The team has contacted the exploiter to offer the maximum bounty as set by our program.
3. The team is cooperating with security and network partners, including Binance.
4. Supply, Redeem, Borrow, Repay, Bridge, and Bridge redemption functions are disabled until further notice. Claiming is available.

We want to thank all the individuals, security partners, and projects who reached out and helped with information. We are continuing to investigate and are in communications with Binance. Further updates and a full report will be shared as they become available.

Qubit. Lend to ascend, borrow for tomorrow.

https://qbt.fi/

https://docs.qbt.fi/

Qubit Official Channels

Twitter: https://twitter.com/QubitFin

Telegram: https://t.me/QubitFinOfficial

Discord: https://discord.gg/JGJBWRxX2Y

Dear qubitians!

We gladly announce that Qubit has entered into a strategic partnership with Lexer, an up and coming derivatives trading protocol.

TLDR;

• Lexer(link) is a one-stop derivatives maker that will give unprecedented ease for trading Leveraged token, Crypto Index, and Option.
• Lexer will use leveraged positions on the Qubit money markets and, thus, it will eventually raise the utilization of Qubit markets.
• The Lexer team consists of professionals with backgrounds from financial engineering, software development and design.
• The Lexer team will host their pre-liquidity mining program in Feb.

Why Lexer is special

Lexer Finance is a decentralized finance protocol for decentralized derivatives. ‘Leveraged Tokens’ will be the first derivative product after launch. Lexer Finance will provide crypto investors a solution to create and trade decentralized leveraged tokens underlain by crypto assets, such as BTC, ETH, BUSD, and etc.

Unlike other derivatives platforms, Lexer Finance provides derivatives products with abundantly capitalized funds and low trading fees through Lexer’s decentralized exchange. In addition, the team will develop strategic partnerships with promising lending protocols, which allow Lexer Finance to have a stable collateral ratio in the future.

Lexer Finance’s team members consist of experienced finance professionals and senior blockchain developers who believe that DeFi is the future of all things finance. Their primary goal is to lower the barrier to entry for cryptocurrency derivatives, and allow anyone to trade and invest in a safe, simple, secure, and decentralized way.

How it benefits Qubit

Lexer will use leveraged positions on the Qubit money markets and will eventually raise the utilization of Qubit markets.

Beyond the ‘Peer-to-peer lending’, our vision for Qubit is to grow as a service that provides ‘lending as a utility’ for the entire BSC ecosystem, a service that is optimized to support developers who are building DApp projects of all kinds. Lexer is one of the many DApps which will use Qubit as its base protocol to use leverage derivatives.

Dear Qubitians,

2021 was an amazing year for Qubit! We’ll be looking back at 2021 and reviewing a number of milestones. We will also discuss the team’s future plans for 2022!

TLDR;

Milestones

• Smart contract audits by global security firms(Peckshield and Theori)
• $250,000 bug bounty program
• Official launch at the end of August
• 1 billion TVL in September
• August monthly stars of MVB III
• Expansion to Klaytn network
• Winner of Binance MVB III program
• Leveraged farming(xLP) API
• Cross-chain collateral for Ethereum network

Roadmap

• Protocol fee sharing
• Launch of Qubit DAO
• QBT buyback campaign proposal
• Interest-bearing tokens as collateral

2021 Recap

Professional Audits before launch

• Smart Contract Audit Report by Peckshield v1.0(link)
• Smart Contract Security Audits by Theory v1.1(link)
• X-Collateral Smart Contract Security Audits by Theory v1.1(link)
• xLP Smart Contract Security Audit by Theory v1.1(link)
• Max $250,000 Bug Bug Bounty Program(link)

Security is our top priority. Global security firms such as Peckshield and Theori completed smart contract audits for the Qubit protocol and all of the underlying contract codes. These audits, along with our $250,000 Bug Bounty program have increased the confidence in Qubit’s security. So far, there has yet to be a single bug found since the launch back in July 2021.

MVB III August Monthly Star

• Announcement by Binance Smart Chain(link)

Qubit was earmarked for August’s monthly stars of Binance Smart Chain Most-Valuable-Builder III program. It was a great honor to be introduced to crypto communities along with many other great projects on BSC. Qubit, especially, got attention from those whose main interest is DeFi lending protocols.

Expansion to Klaytn Network

Qubit was introduced to Klaytn Network. Klaytn is a public blockchain network developed by one of the leading technology companies of South Korea. As the one and only lending protocol on Klaytn network, Qubit has attracted further attention and TVL grew by more than 20 million.

Winner of Binance MVB III program

• Announcement by Binance Smart Chain(link)

Qubit was selected as one of the top 10 finalists of the Binance MVB III program. As a finalist, the project gained a wealth of support from Binance Smart Chain such as private demo-days, business networks, and mentorship programs. Most importantly, it was a meaningful moment to see how supportive our global Qubit community and moderators are! WAGMI

Introduction of state-of-the-art features

Who on earth would have thought that it would be possible to borrow assets on BSC against collateralized assets on Ethereum network! What was previously conceived as impossible is now a reality on Qubit — X-collateral. Users can take leveraged positions without the need of moving assets from one network to another. Unlike other substitutional services like Bridges, there is no commission or fee for the service, which saves a substantial cost for users.

Additionally, we launched xLP, our leveraged farming product in December. xLP allows other yield farming protocols, such as PancakeBunny, to use LP leverage API and get higher yields. There will be more DApps using xLP as its underlying protocol, which will increase the utilization rate of Qubit liquidity pools.

Plans for 2022

Protocol fee sharing

QBT holders who lock their QBT will be eligible to claim accrued protocol fees, leading to great monetary benefits for holders.

Launch of Qubit DAO

A Qubit-based Decentralized Autonomous Organization, a.k.a. DAO will be launched. QBT tokens will represent proportional voting power for decision making within the Qubit protocol.

QBT buyback campaign proposal

QBT buyback program is being researched. Conceptually, this will further increase the demand for QBT tokens. Portions of the protocol fees may be spent to buy QBT tokens on the open market, with tokens being used when the reward distribution period is over.

Interest-bearing tokens as collateral

When the collateralization of interest-bearing Ethereum tokens is ready, users will be able to stack BSC returns for providing liquidity on the BSC on top of the interest they already earn on their aETH and cETH.

Towards the next-generation DeFi, Qubit will continue to update throughout this year. Stay tuned!

Qubit. Lend to ascend, borrow for tomorrow.

https://qbt.fi/

https://docs.qbt.fi/

Qubit Official Channels

Twitter: https://twitter.com/QubitFin

Telegram: https://t.me/QubitFinOfficial

Discord: https://discord.gg/JGJBWRxX2Y

Dear Qubitians,

Cross-chain Collateralization is now a reality!

Qubit’s revolutionary X-Collateral feature is ready. This feature enables users to collateralize their assets from other blockchains. Starting with Ethereum, holders can use their approved assets to invest on the BSC and utilize its speed, efficiency, and low gas fees to maximize returns!

X-Collateral: Use your Ethereum ETH directly on Qubit!

With the launch of X-Collateral, you can now use ETH as collateral on Qubit without moving it onto the BSC. Instead, use your ETH on Ethereum and mint xETH on Qubit to supply the Qubit money markets!

• X-Collateral will launch 20 Dec 2021 05:00 UTC+0
• Please refer to our docs for more details

To mint xETH to supply Qubit markets:
1. Take the amount of ETH you want to use to supply Qubit’s BSC markets.
2. X-Collateral will then mint xETH (1 ETH = 1 xETH), which you can then use as collateral to borrow on any Qubit market.
3. Qubit will cover the Binance Smart Chain gas fees you incur when you mint xETH.

ETH will be enabled for collateralization on Qubit and other Ethereum tokens will be available for collateralization as well, including interest-bearing tokens such as aETH(AAVE ETH) and cETH(Curve ETH).

We are particularly excited to enable the collateralization of interest-bearing Ethereum tokens– users will be able to stack BSC returns for providing liquidity on the BSC on top of the interest they already earn on their aETH and cETH.

This is a great achievement for the Qubit team and an amazing feature that will both grow and benefit the community.

xLP launched on PancakeBunny!

Leveraged liquidity farming is now live on PancakeBunny!(link)

Bunnies use leverage position with xLP of Qubit. Bunnies get higher yield & Qubitians’ pools get utilized more. It’s just the beginning of numerous strategic partnerships.

A lending protocol is a ‘base lego block’. Qubit is a lending protocol of which vision is to become a base lego-block in the crypto world. There will be more dApps using Qubit as its underlying protocol, meaning that their users are actually using Qubit.

Collateral ratio update

Users can now participate in the Borrow market with a higher borrowing rate. The collateral ratio for the majority of tokens on BSC network will be increased.

• The collateral ratio of BTC, ETH, BNB, USDC, USDT, BUSD will increase from 60% to 75%
• The collateral ratio of CAKE will increase from 50% to 55%
• This update will be effective on 20 Dec 2021 02:00 UTC+0.

Qubit. Lend to ascend, borrow for tomorrow.
https://qbt.fi/
https://docs.qbt.fi/

Qubit Official Channels
Twitter: https://twitter.com/QubitFin
Telegram: https://t.me/QubitFinOfficial
Discord: https://discord.gg/JGJBWRxX2Y

Dear Qubitians, we are excited to announce that the BUNNY token will be available on both the supply and borrow markets of Qubit this week. Get ready to earn rewards using BUNNY!

BUNNY on Qubit BSC

As the integration of protocols is one of our key strategies, BUNNY can now be used as collateral on Binance Smart Chain(BSC) Network!

Details are below;

• BUNNY will be available on BSC.
• The maximum supply cap is 1,000,000 BUNNY in order to prevent any security issues.
• The maximum price of collateral is $5.
• The collateral ratio is 30%.
• BUNNY will be added on December 3, UTC 04:00 AM.

Security is Qubit’s top priority. Therefore, similar to QBT token, we will enforce a maximum limit of $5 for BUNNY price as a collateralization. This means that even if the price goes above $5, BUNNY can only be utilized as collateral with the same price of $5.

Adjusted Reward Distribution on Qubit BSC

As BUNNY will newly be listed on Qubit BSC network, the distribution ratio on Qubit BSC will be adjusted as follows.

• The distribution ratio for BNB, MDX, BUSD, CAKE will decrease by 0.25%, 0.375%, 0.125% and 0.5% respectively.
• The distribution ratio for Bunny Supply will be 1% and Bunny Borrow will be 0.25%.
• This update will be effective from December 3, UTC 04:00 AM.

Increase of Borrowing Capacity on both BSC and Klaytn Network

The borrow cap is planned to increase. Maximize your rewards while managing loan-to-value ratio.

• QBT borrow cap(35,000,000) will increase to 50,000,000
• KQBT borrow cap(2,000,000) will increase to 4,000,000
• This will be applied on December 2, at 06:00 UTC.

Extension of Reward Period on QBT-BNB pool with reduced rewards

One more great news is that you can continue to enjoy the rewards for QBT-BNB Pool for a longer time. Sit back and enjoy your rewards!

• The reward period is extended for one additional month.
• The reward per month for the additional month will be reduced by one third. Therefore approximately 66% of regular monthly rewards.

Qubit. Lend to ascend, borrow for tomorrow.
https://qbt.fi/
https://docs.qbt.fi/

Qubit Official Channels
Twitter: https://twitter.com/QubitFin
Telegram: https://t.me/QubitFinOfficial
Discord: https://discord.gg/JGJBWRxX2Y