In <a href="https://medium.com/&#64;w3a/how-w3a-helps-detect-malicious-token-burning-logic-d55246a4402e" rel="noopener noreferrer nofollow">our previous post</a>, we showcased how Web3 Antivirus reveals hidden risks of token burning by revealing modified sections of smart contract code. Today, we will dissect a similar scheme behind token transfer methods.Shortly after red-flagging the first malicious contract, yet <a href="https://etherscan.io/address/0xeBb389C240A5B40452093Be980f29Cf6D308678E" rel="noopener noreferrer nofollow">another dangerous one</a> popped up while we were test-driving our new simulation technology. At a closer look, it was clear that the contract logic had been altered to allow just anyone to secretly transfer user tokens with no approval.The fraud could remain completely unnoticed — this got us thinking of the contract’s issues further. Understanding the reason behind this anomaly was not straightforward; it required careful consideration. The thing was, the contract ran on a ready-made OpenZeppelin’s <a href="https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC721/ERC721.sol" rel="noopener noreferrer nofollow">ERC721</a> while additionally executing custom logic.A healthy token transfer workflow: What does it look like?First, let’s focus on a typical NFT transfer process behind ERC721 contracts. There are several variations of transfer methods, including:1. SafeTransferFrom method;2. TransferFrom method;3. Several internal methods that cannot be accessed externally.Now, examine the conventional transfer method example:<img src="https://miro.medium.com/v2/resize:fit:700/1*_e4rDeuWCzbzrFnY5wujwA&#64;2x.jpeg" />Each transfer method follows a nearly identical initiation process, starting with a check of operation approval. This check ensures that the initiator has the necessary rights to initiate the transfer:<img src="https://miro.medium.com/v2/resize:fit:700/1*RJHOD73zXWzkqA0HACALdg&#64;2x.jpeg" />Again, it’s either the token owner or the approved party who can initiate the process. As we take a closer look at the _isApprovedOrOwner method used during the check, we should pay extra attention to the parameters sent there.Normally, the method should receive two parameters:<ol><li>The wallet address of the initiator behind the transfer transaction (basically, that’s what the check is for);</li></ol><img src="https://miro.medium.com/v2/resize:fit:700/1*hdNzwpogzQnDeJwScAuI2Q&#64;2x.jpeg" />2. The identifier of the token being transferred.At first glance, no rocket science. But what if we scrutinize the problematic method where something went wrong?The malicious method unveiledGiven that we take a quick peek at the method, the issue may remain under covers:<img src="https://miro.medium.com/v2/resize:fit:700/1*-mxjPGR_wJ3eblvdias9UQ&#64;2x.jpeg" />Yet, it’s way simpler to notice the underlying twist by setting a couple of methods against each other. This way, we can see that the problem specifically roots in the variables within the check:<img src="https://miro.medium.com/v2/resize:fit:700/1*ARYGZ3FalrEFuCf_0Tsn2g&#64;2x.jpeg" />In fact, the highlighted variable isn’t supposed to be there — it’s totally out of the ERC721 standard. And it’s exactly the injected value that makes the check run counter to our expectations.One may suppose that it’s a mere coding mistake that happens from time to time. But no, it’s quite the opposite. The engineer took a pre-built ERC721 contract as a basis and intentionally modified the variable, derailing the normal method process to enable secret token transfers. Impressive, and not in a good way.Expect more practical features any time soon!

How W3A Exposes Unapproved Token Transfer

Web3 Antivirus

2023년 5월 18일에 게재된 다른 기사

Jack Dorsey’s Cash App generates $50 million profit from Bitcoin in Q1 2023

ArbDoge.AI Unveils Pricing Details for Truth AIDOGE NFT Collection

NFTb’s New Gaming Hub Set to Revolutionize the Web3 Gaming Landscape

Crypto Aman YouTuber Alleges $80,000 Scam Involving Gate.io Exchange

SEC Hinman Docs Potential Release by June 6, Alongside Ripple’s Acquisition of Swiss Custody Firm...

Block completes prototype ASIC chip for open source Bitcoin mining rigs

무료 뉴스레터에 가입하여 매일 최신 암호화폐 소식을 받아보세요!