ETHW confirms contract vulnerability exploit, dismisses replay attack claims – Cointelegraph

The proof-of-work fork of the Ethereum blockchain was targeted by a cross-chain contract exploit.
Post-Ethereum Merge proof-of-work (PoW) chain ETHW has moved to quell claims that it had suffered an on-chain replay attack over the weekend.
Smart contract auditing firm BlockSec flagged what it described as a replay attack that took place on Sept. 16, in which attackers harvested ETHW tokens by replaying the call data of Ethereum’s proof-of-stake (PoS) chain on the forked Ethereum PoW chain.
According to BlockSec, the root cause of the exploit was due to the fact that the Omni cross-chain bridge on the ETHW chain used old chainID and was not correctly verifying the correct chainID of the cross-chain message.
Ethereum’s Mainnet and test networks use two identifiers for different uses, namely, a network ID and a chain ID (chainID). Peer-to-peer messages between nodes make use of network ID, while transaction signatures make use of chainID. EIP-155 introduced chainID as a means to prevent replay attacks between the ETH and Ethereum Classic (ETC) blockchains.
1/ Alert | BlockSec detected that exploiters are replaying the message (calldata) of the PoS chain on @EthereumPow. The root cause of the exploitation is that the bridge doesn't correctly verify the actual chainid (which is maintained by itself) of the cross-chain message.
BlockSec was the first analytics service to flag the replay attack and notified ETHW, which, in turn, quickly rebuffed initial claims that a replay attack had been carried out on-chain. ETHW made attempts to notify Omni Bridge of the exploit at the contract level:
Had tried every way to contact Omni Bridge yesterday.

Bridges need to correctly verify the actual ChainID of the cross-chain messages.

Again this is not a transaction replay on the chain level, it is a calldata replay due to the flaw of the specific contract. https://t.co/bHbYR4b2AW pic.twitter.com/NZDn61cslJ
An analysis of the attack revealed that the exploiter started by transferring 200 WETH through the Omni bridge of the Gnosis chain before replaying the same message on the PoW chain, netting an extra 200 ETHW. This resulted in the balance of the chain contract deployed on the PoW chain being drained.
Related: Cross-chains in the crosshairs: Hacks call for better defense mechanisms
BlockSec’s analysis of the Omni bridge source code showed that the logic to verify chainID was present, but the verified chainID used in the contract was pulled from a value stored in the storage named unitStorage.
The team explained that this was not the correct chainID collected through the CHAINID opcode, which was proposed by EIP-1344 and exacerbated by the resulting fork after the Ethereum Merge:
This allowed attackers to harvest ETHW and potentially other tokens owned by the bridge on the PoW chain and go on to trade these on marketplaces listing the relevant tokens. 
Cointelegraph reached out BlockSec to ascertain the value extracted. Yajin Zhou, BlockSec CEO, said his team had not conducted an accurate calculation but highlighted a limit on wrapped ETH transfers (WETH) through the Omni Bridge:
Following Ethereum’s successful Merge event, which saw the smart contract blockchain transition from PoW to PoS, a group of miners decided to continue the PoW chain through a hard fork. 

source

Note that any programming tips and code writing requires some knowledge of computer programming. Please, be careful if you do not know what you are doing…

Post expires at 10:40pm on Sunday March 19th, 2023

Leave a Reply

Next Post

British regulator lists FTX crypto exchange as 'unauthorized' firm - Cointelegraph

Mon Sep 19 , 2022
The Financial Conduct Authority claims that the company “may be providing financial services or products without authorization.” The Financial Conduct Authority (FCA), the chief financial regulator in the United Kingdom, issued a warning to Bahama-based crypto exchange FTX, claiming it operates without authorization. The company joined a growing list of […]
%d bloggers like this: