In <a href="https://medium.com/&#64;w3a/how-w3a-helps-detect-malicious-token-burning-logic-d55246a4402e" rel="noopener noreferrer nofollow">our previous post</a>, we showcased how Web3 Antivirus reveals hidden risks of token burning by revealing modified sections of smart contract code. Today, we will dissect a similar scheme behind token transfer methods.Shortly after red-flagging the first malicious contract, yet <a href="https://etherscan.io/address/0xeBb389C240A5B40452093Be980f29Cf6D308678E" rel="noopener noreferrer nofollow">another dangerous one</a> popped up while we were test-driving our new simulation technology. At a closer look, it was clear that the contract logic had been altered to allow just anyone to secretly transfer user tokens with no approval.The fraud could remain completely unnoticed — this got us thinking of the contract’s issues further. Understanding the reason behind this anomaly was not straightforward; it required careful consideration. The thing was, the contract ran on a ready-made OpenZeppelin’s <a href="https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC721/ERC721.sol" rel="noopener noreferrer nofollow">ERC721</a> while additionally executing custom logic.A healthy token transfer workflow: What does it look like?First, let’s focus on a typical NFT transfer process behind ERC721 contracts. There are several variations of transfer methods, including:1. SafeTransferFrom method;2. TransferFrom method;3. Several internal methods that cannot be accessed externally.Now, examine the conventional transfer method example:<img src="https://miro.medium.com/v2/resize:fit:700/1*_e4rDeuWCzbzrFnY5wujwA&#64;2x.jpeg" />Each transfer method follows a nearly identical initiation process, starting with a check of operation approval. This check ensures that the initiator has the necessary rights to initiate the transfer:<img src="https://miro.medium.com/v2/resize:fit:700/1*RJHOD73zXWzkqA0HACALdg&#64;2x.jpeg" />Again, it’s either the token owner or the approved party who can initiate the process. As we take a closer look at the _isApprovedOrOwner method used during the check, we should pay extra attention to the parameters sent there.Normally, the method should receive two parameters:<ol><li>The wallet address of the initiator behind the transfer transaction (basically, that’s what the check is for);</li></ol><img src="https://miro.medium.com/v2/resize:fit:700/1*hdNzwpogzQnDeJwScAuI2Q&#64;2x.jpeg" />2. The identifier of the token being transferred.At first glance, no rocket science. But what if we scrutinize the problematic method where something went wrong?The malicious method unveiledGiven that we take a quick peek at the method, the issue may remain under covers:<img src="https://miro.medium.com/v2/resize:fit:700/1*-mxjPGR_wJ3eblvdias9UQ&#64;2x.jpeg" />Yet, it’s way simpler to notice the underlying twist by setting a couple of methods against each other. This way, we can see that the problem specifically roots in the variables within the check:<img src="https://miro.medium.com/v2/resize:fit:700/1*ARYGZ3FalrEFuCf_0Tsn2g&#64;2x.jpeg" />In fact, the highlighted variable isn’t supposed to be there — it’s totally out of the ERC721 standard. And it’s exactly the injected value that makes the check run counter to our expectations.One may suppose that it’s a mere coding mistake that happens from time to time. But no, it’s quite the opposite. The engineer took a pre-built ERC721 contract as a basis and intentionally modified the variable, derailing the normal method process to enable secret token transfers. Impressive, and not in a good way.Expect more practical features any time soon!

How W3A Exposes Unapproved Token Transfer

Web3 Antivirus

Outros artigos publicados em 18 de mai. de 2023

SEC goes after Bitcoin miner Marathon soon after it announced plans to expand in Abu Dhabi

Binance Australia Suspends Bank Transfers After Provider Backs Out

What are DRC-20 Tokens? How to Mint DRC20 tokens Successfully?

Why Aviation Hasn’t Adopted Blockchain

Coinbase One launches amid regulatory challenges

LayerZero and Immunefi Unveil $15m Bug Bounty

Join our free newsletter for daily crypto updates!