<h2 id="header-0">Background</h2>On December 5, 2023, thirdweb, a Web3 foundational development platform, reported security vulnerabilities in its pre-built smart contracts. This issue affects all tokens deployed using these pre-built smart contracts, including ERC20, ERC721, and ERC1155 tokens. (For specific details on the affected contract code versions, refer to: <a href="https://blog.thirdweb.com/security-vulnerability" rel="noopener noreferrer nofollow">Thirdweb’s security vulnerability blog post</a>.<img src="https://miro.medium.com/v2/resize:fit:700/0*KiHMf1ZVY89hFq3a" />Based on the research from the SlowMist security team, on December 7, 2023, the Time token on the Ethereum mainnet was attacked due to this vulnerability, resulting in the attacker stealing approximately $190,000. Currently, many vulnerable token contracts are still under attack. The immediately investigated this incident and these are our findings:<h2 id="header-1">Preliminary Knowledge</h2>1. ERC-2771 is a standard for meta-transactions. It allows users to delegate the execution of transactions to a third party, known as a Forwarder, commonly referred to as a relay or forwarder.In typical contract interactions, the address of the direct caller is obtained using &#96;msg.sender&#96;. However, in the case of ERC-2771 implementation, if &#96;msg.sender&#96; is a forwarder role, the contract will truncate the incoming &#96;calldata&#96; and extract the last 20 bytes to use as the direct caller’s address for the transaction.<img src="https://miro.medium.com/v2/resize:fit:700/0*ZW5cneuJZ6xbO4_V" />2. Multicall is a smart contract library designed to allow the batch execution of multiple function calls, thereby reducing transaction costs. This library is commonly used to optimize the performance and user experience of DApps, especially when multiple read operations are required.From the code analysis, it can be observed that the vulnerable contracts in the thirdweb project utilize the Multicall library by executing other functions in the contracts that reference this library through a loop of &#96;DelegateCall&#96; function calls. This approach is a key factor in how the contracts interact with and process batched function calls.<img src="https://miro.medium.com/v2/resize:fit:700/0*XPc4oIae3MPjG7WE" /><h2 id="header-2">Root Cause</h2>The root cause of the vulnerability lies in the token contracts’ simultaneous use of ERC-2771 and the Multicall library. The attacker exploits this by calling the &#96;execute&#96; function of the Forwarder contract to invoke the &#96;multicall&#96; function of the token contract, thereby executing other functions within the contract (such as burning tokens). This method successfully passes the &#96;isTrustedForwarder&#96; check of ERC-2771, ultimately interpreting the function caller as the last 20 bytes of the malicious &#96;calldata&#96;. As a result, the attacker deceives the contract into mistakenly recognizing the caller as another user’s address, leading to the burning of tokens belonging to other users.<h2 id="header-3">Steps in the Attacks</h2>Using the attack transaction 0xecdd11…f6b6 as an example, let’s analyze the steps involved:1. The attacker first exchanges 5 WETH (Wrapped Ethereum) for 345,539,9346 Time tokens in a Uniswap V2 liquidity pool.<img src="https://miro.medium.com/v2/resize:fit:700/0*GklF2SiFt2Ylt-TL" />2. Next, the attacker calls the &#96;execute&#96; function of the Forwarder contract, constructing malicious &#96;data&#96; to invoke the &#96;multicall&#96; function of the token contract. At this point, the token contract performs a &#96;delegateCall&#96; using the attacker’s malicious &#96;data&#96; to execute its &#96;burn&#96; function, resulting in the burning of 62,227,259,510 Time tokens from the pool’s address.<img src="https://miro.medium.com/v2/resize:fit:700/0*FQXawWZXR6Ub6GOZ" />3. As a result of the previous step, where a significant amount of Time tokens in the pool were burned, the price of Time tokens was instantly driven up. Consequently, the attacker then reverses the initial swap of Time tokens acquired in the first step, effectively draining 94 WETH from the pool.<h2 id="header-4">Analysis of Attack Method</h2>In the &#96;execute&#96; function of the Forward contract, after verifying the signature of &#96;req.from&#96;, it interacts with &#96;req.to&#96; (the token address) using &#96;call&#96;. The &#96;req.data&#96; provided by the attacker in this instance is:<img src="https://miro.medium.com/v2/resize:fit:621/0*MWXCaw7r2OR7n72M" /><img src="https://miro.medium.com/v2/resize:fit:700/0*zDo585nsijNAYPw4" />The reason &#96;0xac9650d8&#96; is mentioned is because it is the function signature of the &#96;multicall&#96; function. Thus, it triggers the call to the token contract’s &#96;multicall&#96; function. The &#96;data&#96; value passed into the &#96;multicall&#96; function is &#96;0x42966c680000000000000000000000000000000000000000c9112ec16d958e8da8180000760dc1e043d99394a10605b2fa08f123d60faf84&#96;.Why doesn’t the &#96;data&#96; value passed into the &#96;multicall&#96; function include &#96;req.from&#96;? This is because, at the EVM (Ethereum Virtual Machine) level, when processing a &#96;call&#96; invocation, the necessary values are truncated based on the offset within the call. The attacker’s &#96;calldata&#96; sets the offset at 38, with a length of 1, so the exact truncated &#96;data&#96; value ends up being &#96;42966c680000000000000000000000000000000000000000c9112ec16d958e8da8180000760dc1e043d99394a10605b2fa08f123d60faf84&#96;.<img src="https://miro.medium.com/v2/resize:fit:700/0*2w_9TlmqZAgQF22z" />For a detailed understanding, refer to the EVM opcode description of call (<a href="https://www.evm.codes/?fork&#61;shanghai" rel="noopener noreferrer nofollow">EVM Opcode Documentation</a>).<img src="https://miro.medium.com/v2/resize:fit:700/0*B9XgePBENn8367fc" />Since 0x42966c68 is the function signature for the burn function, the attacker’s constructed data value triggers a delegatecall to the token contract’s burn function.<img src="https://miro.medium.com/v2/resize:fit:700/0*DWoQSs9YWlVKMJR1" />The _msgSender() function is overridden by the ERC-2771 library.<img src="https://miro.medium.com/v2/resize:fit:700/0*jbh8zG3R4uNM6H9h" />Because the multicall is invoked via delegatecall, the msg.sender passed to isTrustedForwarder is actually the address of the Forward contract. This successfully bypasses the check, ultimately leading _msgSender() to return the last 20 bytes of the input calldata, which is the pool’s address 0x760dc1e043d99394a10605b2fa08f123d60faf84.<h2 id="header-5">Conclusion</h2>The fundamental cause of this attack lies in the contract’s simultaneous use of Multicall and ERC2771Context. Attackers can insert malicious &#96;calldata&#96; into forwarding requests, exploiting the &#96;delegatecall&#96; functionality of Multicall to pass through trusted forwarder checks, and manipulate the interpretation of &#96;_msgSender()&#96; in sub-calls. This enables them to control tokens belonging to any user.The SlowMist security team advises developers not to use Multicall and ERC2771Context together when programming token contracts. If there is a need to reference both, it is crucial to check whether the &#96;calldata&#96; length meets the expectations or to use the latest official versions of Multicall and ERC2771Context contracts from OpenZeppelin.<h3 id="references">References</h3>Attacker’s address: 0xfde0d1575ed8e06fbf36256bcdfa1f359281455aAttack contract: 0x6980a47bee930a4584b09ee79ebe46484fbdbdd0Related attack transaction: <a href="https://etherscan.io/tx/0xecdd111a60debfadc6533de30fb7f55dc5ceed01dfadd30e4a7ebdb416d2f6b6" rel="noopener noreferrer nofollow">https://etherscan.io/tx/0xecdd111a60debfadc6533de30fb7f55dc5ceed01dfadd30e4a7ebdb416d2f6b6</a>Details of affected versions: <a href="https://blog.thirdweb.com/security-vulnerability/" rel="noopener noreferrer nofollow">https://blog.thirdweb.com/security-vulnerability/</a>Mitigation tool: <a href="https://mitigate.thirdweb.com/" rel="noopener noreferrer nofollow">https://mitigate.thirdweb.com/</a><h3 id="about-slowmist">About SlowMist</h3>At SlowMist, we pride ourselves on being a frontrunner in blockchain security, dedicating years to mastering threat intelligence. Our expertise is grounded in providing comprehensive security audits and advanced anti-money laundering tracking to a diverse clientele. We’ve established a robust network for threat intelligence collaboration, positioning ourselves as a key player in the global blockchain security landscape. We offer tailor-made security solutions that span from identifying threats to implementing effective defense mechanisms. This holistic approach has garnered the trust of numerous leading and recognized projects worldwide, including names like Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, and Cheers UP. Our mission is to ensure the blockchain ecosystem is not only innovative but also secure and reliable.SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. They offer AML (Anti-money laundering) software, Vulpush (Vulnerability monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) , Safe Staking and other SaaS products. They have partnerships with domestic and international firms such as Akamai, BitDefender, FireEye, RC², TianJi Partners, IPIP, etc.By delivering a comprehensive security solution customized to individual projects, they can identify risks and prevent them from occurring. Their team was able to find and publish several high-risk blockchain security flaws. By doing so, they could spread awareness and raise the security standards in the blockchain ecosystem.&#x1f4ac;<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">Website</a> &#x1f426;<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">Twitter </a>⌨️<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">GitHub</a>

An In-depth Analysis of Arbitrary Address Spoofing Attacks

Table of Contents

SlowMist

Other articles published on Dec 12, 2023

New Crypto Presale TG.Casino Nears $4M Milestone As Crypto Whales Buy Early - Is This The Next Ro...

FTX and IRS Tussle Over $24Bn in Unpaid Taxes Could Delay Recovery

BitMart Lists Zero-Knowledge DeFi Pioneer Panther Protocol’s $ZKP

Crypto Gainers Of the Day: INJ, KCS, IMX, and SNX Lead Bull Rally

Top 3 Cryptos Set to Dominate 2024: Solana, Rebel Satoshi, and XRP

U.S. Investigates Nvidia’s AI Chips for China

Join our free newsletter for daily crypto updates!