Are You Sure There is No Backdoor to Your Coins?

Backdoors aren’t ever noticed by the everyday users of a cryptocurrency/platform. There are still plenty of points at which centralisation can re-enter and exert control.

Ignorance of how cryptocurrencies and blockchains work is a big moneymaker, at least if the growth industry in articles, websites, and comparison tools dedicated to explaining crypto is indicative of anything. But it would also seem to be a profit-generator in another, more marginal way.

For example, in the beginning of June it was revealed that Singaporean company Soar Labs had used a ‘backdoor’ in the code of its Soarcoin token to steal back 6.6 million dollars’ worth of the cryptocurrency.

On the one hand, this seizure underlines the risk that other altcoins have backdoors written into their code that would allow developers to reclaim tokens at will from their holders. But on the other, it also underlines the danger of assuming that cryptocurrencies and blockchains are ‘trustless,’ and it suggests that token holders may need to become more technically literate in order to protect their investments.

Stakes, sales and seizures

Last June, the Singapore-based Soar Labs purchased a 49% stake in Byte Power Party, paying for this stake primarily in the form of its own cryptocurrency, Soarcoin. Unfortunately, it soon became unhappy that the Australian Byte Power Party started selling Soarcoin at not “manageable levels,” largely for the purposes of paying off debts.

“This constitutes reckless and negligent actions […] and constitutes breach of agreement,” huffed Soar Labs in a January 1 announcement, before suspending some 213,785,594 SOAR from two wallets owned by Byte.

In fact, the Australian company accused Soar Labs of not simply ‘suspending’ the coins, but of removing them from its wallets altogether. “The board had to deal with the novel issue of cryptocurrency coins being removed from the relevant wallets without authorisation,” it said in a statement.

As a result, it launched legal proceedings against Soar Labs in February. Soon after, Queensland police discovered that a backdoor in Soarcoins’ coding enabled Soar Labs to remove the 213,785,594 tokens, now worth more than USD 3 million.

In technical speak, this backdoor was a “zero-fee transaction function,” which enabled the owner of the smart contract controlling the Soarcoins (i.e. Soar Labs) to “rewrite the balances at will,” as cybersecurity researcher Nicholas Weaver told ISMG (Information Security Media Group).

Arbitrary detention

What’s significant about this case is that Soarcoin is an ERC20, Ethereum-based cryptocurrency. It therefore highlights the possibility that other altcoins, based on Ethereum or other popular blockchains, have backdoors written into them.

There are certain currencies that are rumoured to have a backdoor (e.g. Zcash). However, in a blog published last year, bitcoin developer Udi Wertheimer confirmed that Bancor – an Ethereum-based platform/token that enables direct trading of cryptocurrencies – also contained certain undeclared backdoors that permitted its developers to “take anyone’s [Bancor] tokens arbitrarily,” among other things.

While Bancor defended its implementation of such backdoors in terms of protecting token holders in the event of “a potential security breach,” their existence nonetheless emphasises the fact that some cryptocurrencies remain relatively centralised, with godlike power remaining in the hands of a few actors.

Indeed, Nicholas Weaver later tweeted that any cryptocurrency with an ‘updatable’ smart contract is open to backdoors that could see token holders summarily deprived of their funds.

Bleeding ants

And the existence of backdoors in the world of cryptocurrency isn’t restricted only to cryptocurrencies themselves. Perhaps the most notorious intentional backdoor in crypto is called Antbleed, which was discovered in September 2016 and which essentially allowed Bitmain, the Chinese mining rig manufacturing giant, to remotely switch off Antminer mining units.

Fortunately, Bitmain released a firmware patch for this backdoor in April 2017, yet it nonetheless offers a reminder of two important points:

• Backdoors aren’t ever noticed by the everyday users of a cryptocurrency/platform, but by a researcher or hacker who eventually takes the time to scrutinise its code;
• Despite the ‘decentralisation’ of crypto, there are still plenty of points at which centralisation can re-enter and exert control.

And as the above shows, many of these “points” reside in backdoor lines of code, which 99% of crypto holders are unequipped to check. While this raises concern over what the future of cryptocurrencies and altcoins might have in store for users, it’s worth pointing out the the Soarcoin case is the only known example of a backdoor actually being used. At least for now.