Ethereum

Notable

<p>Thirdweb, a prominent player in developing smart contracts for the Web3 ecosystem, recently identified a significant security vulnerability. This discovery has raised concerns across the Web3 industry, as it potentially impacts a broad array of smart contracts utilized in various applications.</p> 
<p>The affected contracts span diverse domains, including gaming, minting, marketplaces, and wallets. Notably, <a href="https://blog.thirdweb.com/security-vulnerability/" rel="nofollow noopener" target="_blank">according to a blog post,</a> this vulnerability was found in a widely used open-source library, crucial to the operation of these smart contracts. </p> 
<p>Thirdweb has decided not to reveal the name of the open-source library that was the source of the vulnerability or provide any information about the nature of the issue due to its apparent severity. OpenZeppelin, a popular open-source library for smart contracts, has stated that the problem is unrelated to its repository.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">The OpenZeppelin team was informed yesterday Monday (12/4) at 4pm ET by <a href="https://twitter.com/thirdweb?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@thirdweb</a> about a security vulnerability involved in but not limited to Thirdweb’s versions of DropERC20, ERC721, ERC1155 (all versions), and AirdropERC20 pre-built contracts.<br><br>As far as we know, this…</p>— OpenZeppelin (@OpenZeppelin) <a href="https://twitter.com/OpenZeppelin/status/1732004962131923349?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">December 5, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>Despite the severity of the vulnerability, Thirdweb’s thorough investigation revealed that, fortunately, there have been no instances of exploitation to date. This finding provides a crucial window for Web3 firms to implement preventive measures and secure their systems against potential breaches. The vulnerability affects several pre-built contracts, notably DropERC20, ERC721, and ERC1155 standards, among others. Immediate action is necessary to mitigate risks associated with these contracts.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">IMPORTANT <br><br>On November 20th, 2023 6pm PST, we became aware of a security vulnerability in a commonly used open-source library in the web3 industry.<br><br>This impacts a variety of smart contracts across the web3 ecosystem, including some of thirdweb’s pre-built smart contracts.…</p>— thirdweb (@thirdweb) <a href="https://twitter.com/thirdweb/status/1731841493407576247?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">December 5, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<h2 class="wp-block-heading" id="thirdweb-s-proactive-measures-and-community-guidance">Thirdweb’s proactive measures and community guidance</h2> 
<p>In response to the vulnerability, Thirdweb has issued an urgent advisory to its user base, especially those who deployed contracts before November 22. The firm is guiding developers and users to take independent mitigation steps. This includes using tools provided by Thirdweb or employing solutions like revoke.cash, as recommended by DefiLlama developer “0xngmi”. These steps are essential for users who may opt not to update their contracts immediately.</p> 
<p>Moreover, Thirdweb has contacted the maintainers of the affected open-source library and other teams that the issue might impact. To bolster its security protocols, Thirdweb has doubled its bug bounty payouts, increasing them from $25,000 to $50,000. This significant increase underscores the firm’s commitment to fortifying its security measures and ensuring the safety of its smart contract deployment tools. Additionally, a more rigorous auditing process is being implemented to enhance overall security.</p> 
<h2 class="wp-block-heading" id="responsive-actions-to-safeguard-the-web3-ecosystem"> Responsive actions to safeguard the Web3 ecosystem</h2> 
<p>The disclosure of this vulnerability has prompted a wave of responses from various industry players. Notable NFT marketplaces like OpenSea and Rarible, as well as Ethereum layer-2 scaling network Base, have acknowledged the potential impact on their platforms and are working to assist affected collection owners.&nbsp;</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">We are in touch with <a href="https://twitter.com/thirdweb?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@thirdweb</a> about the security vulnerability impacting some NFT collections. Stay tuned for more info on how we can assist affected collection owners with any changes on OpenSea tied to contract migration. Please read <a href="https://twitter.com/thirdweb?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@thirdweb</a>’s post below for more detail. <a href="https://t.co/HU6bmXWU7U" rel="nofollow" target="_blank">https://t.co/HU6bmXWU7U</a></p>— OpenSea (@opensea) <a href="https://twitter.com/opensea/status/1731887099153125528?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">December 5, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>Coinbase, another major entity in the space, <a href="https://twitter.com/coinbase_nft/status/1731850381594898818" rel="nofollow noopener" target="_blank">revealed</a> that some collections on its NFT platform are impacted. In contrast, smart contract startup Manifold <a href="https://twitter.com/manifoldxyz/status/1732097992126234952" rel="nofollow noopener" target="_blank">confirmed</a> its contracts are unaffected.</p> 
<p>Prominent projects such as Cool Cats and Animoca Brands’ Mocaverse have taken steps to migrate their NFT collections to new contracts, ensuring the security of their assets.&nbsp;</p>

Web3 firm Thirdweb uncovers major security flaw in smart contracts

Table of Contents

Cryptopolitan_News

Other articles published on Dec 6, 2023

Cryptocurrency Whale Who Started with 1 Ethereum and Made 275x Profit Has Been Identified – Here ...

Listing News from South Korea Made This Altcoin Rise! Price Increased 15 Percent in a Short Time!

DEBT Box to Request Dismissal of Case Amidst SEC Allegedly Lied

Jamie Dimon Would Close Down Bitcoin If He Were In Government

IBStoken live on polygon network , Now you can used both bep-20 and polygon network for ibstoken ...

Societe Generale to list controversial stablecoin on Bitstamp

Join our free newsletter for daily crypto updates!