Dan Romero
@dwr.eth
Would be curious what @aman @scharf think happened with the Kevin Rose hack? https://twitter.com/0xquit/status/1618335012176400384?s=46&t=EDpYmItVCL0dWiilP6A4TA
12 replies
0 recast
0 reaction
Aman Dhesi
@aman
It was a seaport bulk listing attack - Kevin signed a gasless signature that sold all his NFTs for 0ETH to the attacker. The attacker then submitted the signature to the Seaport contract and that executed the "sale". We're in the process of recreating the original signature and writing a post-mortem
3 replies
0 recast
0 reaction
Dan Romero
@dwr.eth
Naive question: is this a gasless signature as well? Feels like thinking that since there's no transaction confirmation it's OK to sign? https://i.imgur.com/tAgs4hY.png
2 replies
0 recast
0 reaction
Agost Biro
@agostbiro
Yeah, this is a big problem. Can also happen with meta-transactions where the user just signs an off-chain sig for “gasless”
0 reply
0 recast
0 reaction
Aman Dhesi
@aman
Yeah this is a gasless signature that's using the "personal_sign" RPC method. This method is harmless because it cant be used to sign structured JSON messages. Still I would recommend installing @stelo because it's currently too easy to confuse harmful signatures for harmless ones.
1 reply
0 recast
0 reaction
