Security

Today, Maestro, one of the projects on the popular messaging app Telegram, faced a security breach that resulted in a breach of user accounts.  
The breach occurred due to a critical security vulnerability within the project's Router2 contract, which led to unauthorized transfers of over 280 ETH, equivalent to $500,000.  
The Router2 contract, primarily responsible for managing token swaps, had a vulnerability that enabled attackers to perform unauthorized actions, including asset transfers.  
Security firm PeckShield reported that the stolen funds were sent to the cross-chain exchange platform Railgun, possibly in an attempt to obscure their origin.  
The core issue lay in the contract's design, which allowed changes to its logic without modifying its address. While this feature is typically intended for updates, it also makes it possible for arbitrary and unauthorized calls to be made.  
Attackers exploited this vulnerability by initiating "transferFrom" operations using the Router2 contract. They entered a token address, set the function to "transferFrom," and specified the victim's address as the sender and their own address as the recipient. This allowed them to move tokens from the victim's accounts to their own.  
Upon discovering the breach, Maestro acted swiftly to replace the Router2 contract's logic with a harmless countercontract. This action effectively froze all router operations, preventing further unauthorized transfers. 
The post <a rel="noopener noreferrer nofollow" href="https://optimisus.com/news/crypto-news/telegram-bot-maestro-falls-victim-to-contract-exploit-losing-500000-in-eth/">Telegram Bot Maestro Falls Victim to Contract Exploit, Losing $500,000 in ETH</a> appeared first on <a rel="noopener noreferrer nofollow" href="https://optimisus.com">Optimisus</a>.

Telegram Bot Maestro Falls Victim to Contract Exploit, Losing $500,000 in ETH

Optimisus

Other articles published on Oct 25, 2023

Over 1,000 Indian police caught up in $240M crypto scam

The UK Financial Conduct Authority (FCA) Implements New Rules to Regulate Crypto Companies

Coinbase on final push to dismiss SEC lawsuit

Glacier Network Announces the Launch of Next Gen SDK Version 2.0 to Accelerate Dapp Development

Nocturne Raises $6M From Vitalik Buterin, Polychain, Bankless and Bain Capital Crypto to Enable P...

Uniswap Foundation Sells Off $43M Worth of UNI Tokens in Three Days

Join our free newsletter for daily crypto updates!