Arbitrum

Monero

Foundation

TRON

Read

<p class="is-style-lead">Security researchers have recently disclosed a critical zero-day vulnerability in the TRON blockchain that could potentially expose $500 million worth of cryptocurrency to theft.</p>



<p>The vulnerability, discovered by the 0d research team at dWallet labs, specifically targeted multisig accounts on the TRON blockchain.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">0d, our superstar cybersecurity research team, discovered a vulnerability in TRON multisig accounts putting over $500M of digital assets at risk &#8211; it was disclosed and fixed so there are no user assets at risk now.<br><br>A technical breakdown:<a href="https://t.co/nMj6kV6Oc3" target="_blank">https://t.co/nMj6kV6Oc3</a></p>&mdash; dWallet Labs (@dWalletLabs) <a href="https://twitter.com/dWalletLabs/status/1663492997005074433?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">May 30, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>Multisig accounts require multiple signatures to authorize a transaction. However, the flaw in TRON&#8217;s approach to multisig allowed any signer associated with a particular multisig account to gain access to the funds within that account independently, without requiring the approval of other signers.</p>



<p>This oversight in TRON&#8217;s verification process enabled the attack to bypass the blockchain&#8217;s multisig security entirely.</p>



<figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
<iframe title="Multisignature Wallets Explained | Animation | Cryptomatics" width="1020" height="574" src="https://www.youtube.com/embed/E47Ih7DArKs?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
</div></figure>



<p>Omer Sadika, a member of the 0d research team, explained:</p>



<blockquote class="wp-block-quote">
<p>&#8220;The multisig verification process could have been bypassed by signing the same message with non-deterministic nonces&#8230;Simply put, one signer can create multiple valid signatures for the same message.&#8221;</p>
</blockquote>



<p>The solution to this <a href="https://crypto.news/edge-wallet-security-vulnerability-leaks-2000-private-keys/">critical vulnerability</a> was relatively straightforward, as signatures are now checked against a list of addresses rather than solely relying on a list of signatures.</p>



<div class="cn-block-related-link">

    <svg class="cn-block-related-link__icon icon" aria-hidden="true">
        <use xlink:href="#icon-bookmark"></use>
    </svg>

    
        <span class="cn-block-related-link__prefix">
            You might also like:
        </span>

    
    
        <a href="https://crypto.news/ton-foundation-introduces-new-liquidity-mining-rewards-program/" class="cn-block-related-link__link">
            TON Foundation introduces new liquidity mining rewards program        </a>

    
</div>


<h2 class="wp-block-heading" id="strong-tron-8217-s-swift-response-to-multisig-security-flaw-strong"><strong>TRON&#8217;s swift response to multisig security flaw</strong></h2>



<p>The 0d research team promptly reported the vulnerability through TRON&#8217;s bug bounty program on Feb. 19. TRON swiftly patched the vulnerability within days, and the researchers confirmed that most TRON validators had implemented the necessary patches.</p>



<p>In a separate statement on Twitter, the researchers emphasized that no user assets are currently at risk since the vulnerability has been successfully resolved.</p>



<p>As of now, TRON has not issued its public statement regarding the incident.</p>



<h2 class="wp-block-heading" id="more-recent-vulnerabilities">More recent vulnerabilities</h2>



<p>The latest development coincides with the discovery of a significant privacy vulnerability within the Monero blockchain. Notably, the Monero bug remained undetected on the network for over three years before it was identified and promptly resolved.</p>



<div class="cn-block-related-link">

    <svg class="cn-block-related-link__icon icon" aria-hidden="true">
        <use xlink:href="#icon-bookmark"></use>
    </svg>

    
        <span class="cn-block-related-link__prefix">
            You might also like:
        </span>

    
    
        <a href="https://crypto.news/monero-xmr-team-multisignature-wallet-code/" class="cn-block-related-link__link">
            Monero (XMR) Team Identifies Vulnerabilities in the Multisignature Wallet Code        </a>

    
</div>


<p>In yet another blow to the DeFi sector, the Jimbos Protocol, built on the Arbitrum network, fell victim to a severe exploit resulting in the loss of 4,000 Ether, equivalent to approximately<a href="https://twitter.com/WuBlockchain/status/1662672024123379714" target="_blank" rel="noopener"> $7.5 million</a>. </p>



<p>The recent developments highlight the importance of rigorous security measures and thorough auditing processes in blockchain technologies. Identifying and addressing vulnerabilities swiftly is crucial to maintaining the security and integrity of cryptocurrency networks.</p>



<div class="cn-block-related-link">

    <svg class="cn-block-related-link__icon icon" aria-hidden="true">
        <use xlink:href="#icon-bookmark"></use>
    </svg>

    
        <span class="cn-block-related-link__prefix">
            Read more:
        </span>

    
    
        <a href="https://crypto.news/uae-and-hong-kong-central-banks-collab-on-bolstering-crypto-regulations/" class="cn-block-related-link__link">
            UAE and Hong Kong central banks collab on bolstering crypto regulations        </a>

    
</div>

Security firm exposes $500m vulnerability in TRON’s multisig accounts

Table of Contents

crypto.news

Other articles published on May 31, 2023

Are Stablecoins the Most Useful Crypto?

2,383 Cryptocurrencies Fail, But a New Era Dawns in the Crypto Industry

CFTC Issues Letter to Staff Addressing Obligations and Clarity on Digital Assets

Web3 Games vs. Traditional Games: A Comparison

DAVE token skyrockets 4,400% in 24 hours

Unveiling the Dynamics of Stablecoins: Tether (USDT) Dominates Amid Shaky Economic Climate

Join our free newsletter for daily crypto updates!