### Security Firms CertiK and Beosin released their Q3 2022 reports, and both agreed that the Nomad, Slope, and Wintermute exploits were important case studies for Web3 security.

According to CertiK's Q3 2022 quarterly security [report](https://certik-2.hubspotpagebuilder.com/hack3d-q3-2022-0-0?utm_source=q3-report&utm_medium=landing-page) (Hack3d), web 3 projects saw USD 504M dollars lost to exploits. Beosin, a competitor firm, released its own [report](https://beosin.com/resources/Q3_2022_BLOCKCHAIN_SECURITY_REPORT.pdf), reporting losses above USD 405 million from the projects it reviewed. 

Both reports agreed that the exploits behind the greatest losses were smart contract bugs and private key compromise. Beosin reported 92 percent of drained funds were due to smart contract bugs and private key compromises, while  CertiK’s analysis had the figure at 85 percent. 

A mere four private key compromises resulted in a massive 167M in losses according to Beosin. 

As to contract vulnerabilities, Beosin cited that validation, reentrancy, permission, improperly designed business logic or functions, and overflow vulnerabilities as key exploits. According to Beosin, these exploits are all preventable at the design and audit phase.

Beosin and CertiK also agreed on the three most important case studies for the quarter: Nomad, Slope, and Winterminute. 

1. Nomad Bridge - Nomad bridge served as a cross-chain bridge allowing funds to be moved between different chains. The exploit occurred after a routine upgrade where the value of an important variable was set to 0. The side-effect of this normally benign practice was that the contract auto-approved one withdrawal transaction per unique address. The result was a large-scale looting that reached close to USD200 Million. Full details on the methodology of the exploit are available from CertiK [here](https://www.certik.com/resources/blog/28fMavD63CpZJOKOjb9DX3-nomad-bridge-exploit-incident-analysis).

2. Slope - The Slope Wallet exploit saw over 9000 addresses lose a combined total of about USD 8 million on the Solana chain. The exploit was in Slope Wallet’s code, which stored users’ seed phrases in plain text on their servers. CertiK’s security takeaway from this was to generate keys offline, and to consider as unsafe any keys generated in —or imported into- internet-connected (hot) wallets.

3. Wintermute - This market maker lost 160M USD due to the use of hack-prone addresses that were supposed to reduce on-chain gas fees. Wintermute used a third-party service called Profanity to generated 256-bit private keys from random 32-bit numbers. Due to the small size of possible random numbers, it was certain that all private keys generated by Profanity could be reproduced. And that is exactly what happened, resulting in total losses of 160M, mostly in the form of USDC, and popular wrapped tokens.

All three of the above exploits were preventable, but Nomad's would have been a little harder to catch, as Beosin's report said it could have *potentially* been caught by a deeper audit. Stay safe out there, everyone, and do your own research as always. 

Sources:
[CertiK Report](https://certik-2.hubspotpagebuilder.com/hack3d-q3-2022-0-0?utm_source=q3-report&utm_medium=landing-page) | [Beosin Report](https://beosin.com/resources/Q3_2022_BLOCKCHAIN_SECURITY_REPORT.pdf)




Security firms CertiK and Beosin released their Q3 2022 reports, and both agreed that the Nomad, Slope, and Wintermute exploits were important case studies for Web3 security.

Thu Nov 03 2022

Nomad, Slope, and Wintermute: Three Case Studies in Web3 Security

Ferrari to Accept Crypto Payments in the US; Plans to Include Europe Underway

Prototype Global Cryptoasset Mapping System Developed

FTX Founder Sam Bankman-Fried Sent to Jail for Alleged Witness Tampering

Huobi Rocked by Reports of Executive Arrests and Accusations of Customer Fund Misuse

Breaking The Chains: Introducing BRC-69, The Bitcoin Standard Without Data Restrictions

Prototype Global Cryptoasset Mapping System Developed

Thu Nov 03 2022 Nomad, Slope, and Wintermute: Three Case Studies in Web3 Security

Ferrari to Accept Crypto Payments in the US; Plans to Include Europe Underway

Prototype Global Cryptoasset Mapping System Developed

FTX Founder Sam Bankman-Fried Sent to Jail for Alleged Witness Tampering

Huobi Rocked by Reports of Executive Arrests and Accusations of Customer Fund Misuse

Breaking The Chains: Introducing BRC-69, The Bitcoin Standard Without Data Restrictions

Prototype Global Cryptoasset Mapping System Developed

Thu Nov 03 2022

Nomad, Slope, and Wintermute: Three Case Studies in Web3 Security