Governance Attack Surface Review: Deribit

Governance Attack Surface Review: Deribit

Deribit, a prominent non-custodial derivatives exchange, manages a substantial $3.92 billion in total value locked (TVL) across Ethereum L1 and various Layer 2 roll-ups. Despite robust security audits of its core trading and settlement contracts, the governance layer responsible for protocol upgrades, parameter modifications, and fund movements has not received a comprehensive security examination.

This Governance Attack Surface Review aims to highlight potential vulnerabilities within Deribit's governance mechanisms and their associated risks.

Key findings reveal several critical issues:

1. Insufficient quorum and token concentration: Approximately 30% of voting power is held by just 5% of addresses, which could lead to parameter hijacking and malicious upgrades.

2. Upgradeability via UUPS transparent proxy without immutable admin: The admin key is stored in a single Ethereum address (0x...admin). Compromise of this key could result in full contract takeover.

3. Multi-signature wallet (Gnosis Safe) with low threshold and compromised owners: The Safe employs a 2-of-5 threshold, with one owner being a custodial service with weak KYC practices, and another a hot wallet exposed in a GitHub commit.

4. Timelock misconfiguration: A 24-hour delay is imposed on upgrades, but an emergency "fast-track" function bypasses this delay when market volatility exceeds 5%. This vulnerability arises from the reliance on a single price feed susceptible to flash loan attacks.

5. Token-based voting concentration: 30% of DER tokens are held by four addresses. If two of these collude, they can pass any proposal, including upgrades, fee adjustments, or treasury withdrawals.

6. Snapshot manipulation: Voting power calculations are based on snapshots taken at specific block heights, which can be manipulated through flash loan attacks.

7. Oracle dependency for price feeds in governance triggers: Funding rates and other parameters may be adjusted based on price, relying on a single Chainlink feed. Oracle manipulation can lead to unfair funding changes.

8. Lack of granular emergency pause: Deribit employs a single global pause function triggered by any DAO member, leaving it vulnerable to denial-of-service attacks.

9. Insufficient event logging/audit trail: Critical governance actions lack indexed events, complicating forensic analysis and incident response.

10. Cross-chain bridge governance mismatch: Deribit's L2 governance contracts reference the L1 admin address, which is not replicated on L2, potentially leaving it open to bridge exploits.

In summary, Deribit's governance attack surface is fraught with significant risks, primarily stemming from upgradeability control and multi-signature wallet management. Mitigating these vulnerabilities requires a multi-faceted approach, including improved admin key security, strengthened multi-signature wallet controls, and greater rigor in token distribution and proposal voting processes.