On January 17, 2024, according to monitoring data from Beosin EagleEye, Socket Protocol suffered a call injection attack, leading to a significant theft of funds from authorized users. Currently, the attacker has converted the stolen funds to ETH and stored them in the attacker’s address.After the attack, Socket’s official confirmation acknowledged the security breach and promptly suspended the affected contracts.<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/0e2eaa41b8cf43ad87a04892759f183f.png" />Simultaneously, MetaMask posted on the X platform, stating that MetaMask Bridge users are not affected by the Socket vulnerability. MetaMask emphasized their unique architecture in designing cross-chain bridge contracts to mitigate such attacks.<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/bd5d88f4ef16426dadc13698a803a349.png" /><h2 id="header-0">Vulnerability Analysis</h2>The primary cause of this incident is an insecure call invocation in the performAction function of the Socket contract. Despite the absence of checks on fromToken and toToken parameters, the function effectively restricts token addresses to WETH, excluding other ERC20 addresses, preventing the forgery of these parameters indirectly.<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/91880f43080f40e181d65cace6a81662.png" />However, a critical flaw in the function lies in the lack of restrictions on the amount parameter. If the caller provides an amount of 0, the function’s check condition will always pass without the need to call WETH’s deposit and withdraw functions. This allows injecting abnormal data through the call, leading to the exploitation of the vulnerability.<h2 id="header-1">Attack Process</h2>Understanding the vulnerability, let’s explore how the attacker executed the attack:1. Creation of Malicious Contract:<ul><li>The attacker initially created a malicious contract to initiate the attack.</li></ul><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/29ccd16070ec45fd9f6503cd77e7c854.png" />2. Queries and Authorization Checks:<ul><li>Subsequently, the attacker conducted multiple queries on WETH balances from different addresses.</li><li>Additionally, the attacker checked the authorized quantity for the Socket: Gateway contract associated with each address.</li><li>Following this, the attacker called the Socket: Gateway contract.</li></ul><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/7be9673d58c045a8977f592db0a1abf0.png" />3. PerformAction Function Call with transferfrom Signature:<ul><li>In the call to the performAction function, the attacker specified the swapExtraData parameter as 0x23b872dd…</li><li>This data corresponds to the function signature of transferfrom, indicating a direct invocation of the token’s transferfrom function.</li></ul><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/59bf96fb66f047de930b40d0c391a138.png" />4. PerformAction Function Call with transferfrom Signature:<ul><li>In the call to the performAction function, the attacker specified the swapExtraData parameter as 0x23b872dd…</li><li>This data corresponds to the function signature of transferfrom, indicating a direct invocation of the token’s transferfrom function.</li></ul><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/b14ad27cc4ef42c58a72527158f15441.png" />5. WETH Transfer by the Attacker:<ul><li>Through numerous operations, the attacker transferred WETH from countless users to their own address.</li></ul><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/347b73a8c162481d9377006aeecd1e0f.png" />6. Transfer of Authorized USDT in a Similar Manner:<ul><li>The attacker employed a similar method to transfer USDT authorized to the contract to their own address.</li></ul><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/53bc3ae5f81144ff8986a3a1f12e7027.png" />7. Involvement of Other Tokens:<ul><li>The attack extended to include other tokens such as WBTC, DAI, and MATIC.</li></ul><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/2446d24adf3e48fea7e9bd793f73f9fb.png" /><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/223a916bd345421a9d4ad5b6dcbf0183.png" /><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/b7d642e263ff4559bff1aeaf326e1f2d.png" />As of the time of writing, approximately $3.3 million has been stolen, with some funds exchanged for ETH and stored in the hacker’s address. Beosin Trace continues to monitor the stolen funds.<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/5c3fa68677074314a96bb7444ed6a26d.png" />Socket, in an update on the X platform, states that operations have been restored, affected contracts have been suspended, and the situation is under full control. Interoperability with Bungee bridging and most partner front-end bridging has been reinstated. A detailed analysis of the event and subsequent steps will be announced soon.Socket issues a reminder: “Be cautious of fake Socket accounts attempting phishing in your replies. Please carefully verify the account before taking any action.”<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/7788c17d2ae34e6d89a65292d7bb4fdd.png" />This incident serves as a reminder to prioritize security. As we enter 2024, numerous security events have already occurred. Beosin, a globally leading blockchain security company, offers a comprehensive range of blockchain security products and services covering code security audits before project launch, real-time security risk monitoring, alerts and prevention, cryptocurrency asset recovery, security compliance KYT/AML, and more. We are committed to the secure development of the Web3 ecosystem. If needed, feel free to contact us.<h2 id="header-2">Contact</h2>If you need any blockchain security services, welcome to contact us:<a href="https://beosin.com/" rel="noopener noreferrer nofollow">Official Website</a> <a href="https://www.beosin.com/resources/www.eagleeye.space" rel="noopener noreferrer nofollow">Beosin EagleEye</a> <a href="https://twitter.com/Beosin_com" rel="noopener noreferrer nofollow">Twitter</a> <a href="https://t.me/beosin" rel="noopener noreferrer nofollow">Telegram</a> <a href="https://www.linkedin.com/company/beosin" rel="noopener noreferrer nofollow">Linkedin</a>

Socket Protocol Falls Victim to Hacker's Call Injection Attack, Resulting in Approximately $3.3 Million Theft

Table of Contents

Beosin

Other articles published on Jan 18, 2024

Crypto exchanges trading volume surges to $10 trillion in 2023

Solana Price Prediction as Franklin Templeton with $1.5 Trillion AUM Indicates Interest in Solana...

Forbes launches Connect Wallet, signaling web3’s mainstream aspirations

Fidelity’s spot Ethereum ETF decision deferred by SEC

Coinshares Exec on Post-ETF Bitcoin Landscape; AI Crypto Causes Stir on Reddit

UAE license is a gamechanger for OKX

Join our free newsletter for daily crypto updates!