Edge cases, and the math you did not fuzz

Graduate · enrolled learners

This lesson opens with Indexed Finance, October 2021.

What happened

Indexed Finance ran tokenized index pools that held baskets of assets and rebalanced by adjusting the weights of the tokens inside them, including a step that introduced a new asset into a pool at a very small initial weight. An attacker studied the reindexing math and found that in the edge case of a newly added, minimally-weighted asset, the formula that priced the pool's index token could be pushed far from reality, letting them mint or redeem index tokens at a wildly wrong price. Using that edge case they extracted about 16 million dollars from the pools. The attacker was later identified, a teenager, and pursued legally. The contract's math was correct for the ordinary weights the team had in mind and tested with; the flaw lived only at the extreme, in the behavior of the pricing formula when a weight was pushed to a corner the example tests never visited, and that corner was exactly where the value poured out.

The decision point

Bugs in a contract's math hide in its edge cases, the extreme, rare, or boundary inputs where a formula behaves differently than it does for the ordinary values a builder pictures and tests with, and those are precisely the inputs an attacker searches for, so testing a few chosen examples of the normal case leaves the dangerous corners unexamined. Indexed Finance is the case: its reindexing math was correct for ordinary weights and broke only at the edge of a newly added asset held at a tiny weight, where the pricing formula could be pushed far from reality, and an attacker who found that corner drained about 16 million dollars from a formula that passed every example test of the normal case. This sharpens the prior lesson from unhappy paths in general to the math in particular: a formula is not verified by trying a handful of sensible inputs and seeing sensible outputs, because the failure is not in the sensible range; it is at the extremes, and the extremes are infinite, so you cannot enumerate them by hand. This is why fuzzing and property testing exist, throwing many random and extreme inputs at the code and checking that an invariant, a property that must always hold, is never violated, because they reach the corners you would never think to try. So the discipline is to test the math of a contract by its invariants under a flood of extreme inputs, not by a few chosen examples, and to assume that any corner you did not test is a corner an attacker will, because Indexed Finance is what an untested edge in a pricing formula becomes: the exact place the money leaves, found by someone who looked where the example tests did not.

Recorded loss

$16,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.