<h2 id="header-0">Background</h2>On April 24, 2024, according to intelligence from the SlowMist Security Team, the YIEDL project on the BSC chain was attacked, with the attacker stealing approximately $300,000. We conducted an analysis of the attack and these were our findings:<img src="https://miro.medium.com/v2/resize:fit:700/0*vJUOQTQEAdEVpLwN" />(https://twitter.com/SlowMist_Team/status/1782962346039898473)Related InformationAttacker’s Address: 0x322696471792440499b1979e0a440491e870667aContract Address Being Attacked: 0x4edda16ab4f4cc46b160abc42763ba63885862a4Some of the Attack Transactions:0x49ca5e188c538b4f2efb45552f13309cc0dd1f3592eee54decfc9da54620c2ec0x3629ad588ac120163792e92b6c43bd4bdc5bf35cac66eb7f3a0267df93abc8490x0a89b8670c40b4067b9522a5933c3bf8c44c968103aa642b04c65d49ad9e64570x5e468cba495e5f6165418fb9d87d824309c54261055425f33f588dd3b3abbcea0x8710034dadecfc8c26f651c612f613fffdece6e2f9957b9ec8ab843218168c1d0x9da398ed274c8cfa774b36003fa8c930d3430d0fc5889b5008830fd6463f68a90x2e3d4332f66a334e0170187011ed673dc222f95bf4443b618e08f8052437ef7a0x5a15fdc57c35f2305aaa0bb95b109ad412b17406d737d137190fe5867393339d0x8ef3765665cd849cdf9132ab37caf6aa0f891e1f7d9f418f86a6ab6ea38b6f5b0xa9fa04b033afbed2218679aea92e9429a5f7839d0b4c65358ebf9ba20efcd021<h2 id="header-1">Cause of Attack</h2>In this incident, the reason lies in the contract’s failure to adequately validate the external parameter(dataList) provided by the user during the processing of the redeem function call. This parameter is critical data for controlling asset exchanges, typically containing specific transaction instructions or routing information. The attacker maliciously constructed this external parameter, enabling unauthorized asset transfers.<h2 id="header-2">Transaction Analysis</h2>The attacker repeatedly invoked the redeem function with a redemption quantity of 0 assets. This action may seem harmless since a redemption quantity of zero typically doesn’t trigger any actual fund movement.<img src="https://miro.medium.com/v2/resize:fit:700/0*VDLM5PYy3sZTJdtp" />However, delving into the redeem function reveals that it traverses the list of assets allowed by the contract. When the current asset is not the one the user wishes to receive, it parses the dataList parameter and makes an external call to the corresponding function in the 1inch Router contract to execute the asset exchange operation.<img src="https://miro.medium.com/v2/resize:fit:700/0*MHgmr6P1TiE_EmeC" />Due to the unchecked and unverified nature of the dataList parameter, the attacker was able to construct malicious values to execute the unoswapTo function in the 1inch Router contract for arbitrary and controllable token exchanges.<img src="https://miro.medium.com/v2/resize:fit:700/0*fWAXniwBuVYFWMzh" />As a result, WBNB-ADA tokens within the Yiedl BULL contract were exchanged for BNB to the attacker’s address.<img src="https://miro.medium.com/v2/resize:fit:700/0*PPHRdV_eJy4Af5hH" />In this manner, the attacker, without actually owning any redemption shares, triggered token exchange operations controlled by the dataList parameter. By repeatedly mobilizing contract funds without consuming their own assets, the attacker profited and exited.<h2 id="header-3">Conclusion</h2>The core of this attack lies in the failure to adequately validate the dataList parameter, allowing attackers to manipulate external data and drain tokens from the contract using 1inch. The SlowMist Security Team recommends project teams implement rigorous parameter validation mechanisms during development, especially concerning asset operations within contracts. When it comes to the operation of funds in a contract, it is important to ensure that all external calls conform to expected behavioral norms and conduct thorough security audits of contract logic to avoid the recurrence of similar incidents.<h3 id="about-slowmist">About SlowMist</h3>At SlowMist, we pride ourselves on being a frontrunner in blockchain security, dedicating years to mastering threat intelligence. Our expertise is grounded in providing comprehensive security audits and advanced anti-money laundering tracking to a diverse clientele. We’ve established a robust network for threat intelligence collaboration, positioning ourselves as a key player in the global blockchain security landscape. We offer tailor-made security solutions that span from identifying threats to implementing effective defense mechanisms. This holistic approach has garnered the trust of numerous leading and recognized projects worldwide, including names like Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, and Cheers UP. Our mission is to ensure the blockchain ecosystem is not only innovative but also secure and reliable.We offers a variety of services that include but are not limited to security audits, threat intelligence, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) solutions, Vulpush (Vulnerability monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) , Safe Staking and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, FireEye, RC², TianJi Partners, IPIP, etc.By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we wish to help spread awareness and raise the security standards in the blockchain ecosystem.&#x1f4ac;<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">Website</a> &#x1f426;<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">Twitter </a>⌨️<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">GitHub</a>

Analysis of the YIEDL Security Breach

目錄

SlowMist

在 2024年4月29日發表的其他文章

Morgan Stanley Ups the Ante on Bitcoin ETFs

The Yen collapses against Bitcoin

Despite decreases in investment into exchange-traded funds (ETFs), Bernstein maintained its predi...

Gora Network announces the launch of its $GORA token on Ethereum ERC-20

The rise of DePINs: From noise pollution sensors to robo-cafes

Rivian Stock Price Prediction 2030

訂閱免費電子報，每天收取加密貨幣最新動態！