natoil42.eth pfp
natoil42.eth
@natoil42
An alarming wake-up call for the DeFi Radiant Capital's $50M hack may just be the rain before the arrival of a hurricane ready to hit crypto, as the level of sophistication reached is such that no one can feel truly safe right now This hack was not caused by carelessness, or failure to follow security best practices, and although an inside job cannot be ruled out, it would not have been sufficient to pull off the heist, as a 3-of-11 multisignature was required on Ledger hardware wallets belonging to long-standing, trusted contributors to the DAO, who were geographically distributed, to reduce the likelihood of a coordinated physical attack Attackers were able to compromise the devices through a malware injection ā€œin such a way that the front-end of Safe{Wallet} displayed legitimate transaction data while malicious transactions were signed and executed in the backgroundā€ Despite multiple layers of verification on auditing tools, the signed transactions appeared normal on the software interface šŸ§µ1/2
1 reply
0 recast
10 reactions
natoil42.eth pfp
natoil42.eth
@natoil42
This was one of the most sophisticated crypto attacks ever recorded, and many other protocols are at risk of a similar hack. But despite the sophistication, the exploit relies on one of DeFi's most known and critical weaknesses: most smart-contracts uses ABI encoded hash which requires blind-signatures of non-human readable data on hardware wallets. Even if you see realiable data on your mobile/desktop/browser wallet, even if they pass all checks, ultimately what matters is that you are always able to understand and verify what you are signing on your hardware. If you fully trust the software interface, using a hardware wallet as a dedicated signing device makes ZERO sense. Until hardware wallets implement advanced, downloadable, updatable ABI decoding, the only counter-measure is to take raw transaction data when a signature is prompted (e.g., Metamask, Rabby) and paste it into https://etherscan.io/inputdatadecoder to check functions and ToAddress šŸ™ If you like this thread, please put a ā¤ļø and mā€¦
0 reply
0 recast
0 reaction