In <a href="https://medium.com/&#64;w3a/how-w3a-helps-detect-malicious-token-burning-logic-d55246a4402e" rel="noopener noreferrer nofollow">our previous post</a>, we showcased how Web3 Antivirus reveals hidden risks of token burning by revealing modified sections of smart contract code. Today, we will dissect a similar scheme behind token transfer methods.Shortly after red-flagging the first malicious contract, yet <a href="https://etherscan.io/address/0xeBb389C240A5B40452093Be980f29Cf6D308678E" rel="noopener noreferrer nofollow">another dangerous one</a> popped up while we were test-driving our new simulation technology. At a closer look, it was clear that the contract logic had been altered to allow just anyone to secretly transfer user tokens with no approval.The fraud could remain completely unnoticed — this got us thinking of the contract’s issues further. Understanding the reason behind this anomaly was not straightforward; it required careful consideration. The thing was, the contract ran on a ready-made OpenZeppelin’s <a href="https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC721/ERC721.sol" rel="noopener noreferrer nofollow">ERC721</a> while additionally executing custom logic.A healthy token transfer workflow: What does it look like?First, let’s focus on a typical NFT transfer process behind ERC721 contracts. There are several variations of transfer methods, including:1. SafeTransferFrom method;2. TransferFrom method;3. Several internal methods that cannot be accessed externally.Now, examine the conventional transfer method example:<img src="https://miro.medium.com/v2/resize:fit:700/1*_e4rDeuWCzbzrFnY5wujwA&#64;2x.jpeg" />Each transfer method follows a nearly identical initiation process, starting with a check of operation approval. This check ensures that the initiator has the necessary rights to initiate the transfer:<img src="https://miro.medium.com/v2/resize:fit:700/1*RJHOD73zXWzkqA0HACALdg&#64;2x.jpeg" />Again, it’s either the token owner or the approved party who can initiate the process. As we take a closer look at the _isApprovedOrOwner method used during the check, we should pay extra attention to the parameters sent there.Normally, the method should receive two parameters:<ol><li>The wallet address of the initiator behind the transfer transaction (basically, that’s what the check is for);</li></ol><img src="https://miro.medium.com/v2/resize:fit:700/1*hdNzwpogzQnDeJwScAuI2Q&#64;2x.jpeg" />2. The identifier of the token being transferred.At first glance, no rocket science. But what if we scrutinize the problematic method where something went wrong?The malicious method unveiledGiven that we take a quick peek at the method, the issue may remain under covers:<img src="https://miro.medium.com/v2/resize:fit:700/1*-mxjPGR_wJ3eblvdias9UQ&#64;2x.jpeg" />Yet, it’s way simpler to notice the underlying twist by setting a couple of methods against each other. This way, we can see that the problem specifically roots in the variables within the check:<img src="https://miro.medium.com/v2/resize:fit:700/1*ARYGZ3FalrEFuCf_0Tsn2g&#64;2x.jpeg" />In fact, the highlighted variable isn’t supposed to be there — it’s totally out of the ERC721 standard. And it’s exactly the injected value that makes the check run counter to our expectations.One may suppose that it’s a mere coding mistake that happens from time to time. But no, it’s quite the opposite. The engineer took a pre-built ERC721 contract as a basis and intentionally modified the variable, derailing the normal method process to enable secret token transfers. Impressive, and not in a good way.Expect more practical features any time soon!

How W3A Exposes Unapproved Token Transfer

Web3 Antivirus

Other articles published on May 18, 2023

Texas lawmakers approve a bill seeking BTC miners to use cheaper, greener energy

Revolutionize Your Digital Shopping Experience with DIFI Marketplace! 🚀

PepePunks: The Ultimate Deflationary Token With AI and NFT Utility

Experts Are Tipping Tradecurve (TCRV) To Outperform Polkadot (DOT) And TRON (TRX) This Year

Polygon Skyrockets to New Heights: Record-Breaking Growth and Transaction Volume Surge

Celsius Seeks Return of $784.7M Staked Ether from Lido

Join our free newsletter for daily crypto updates!