Very timely post, this is roughly how the recent $611M poly network hack worked. [1] In the attack there were two contracts: the first is a proxy contract whic

Very timely post, this is roughly how the recent $611M poly network hack worked. [1] In the attack there were two contracts: the first is a proxy contract which forwards commands (allowing actors from other chains to interact with Poly. The second contract is a big pile of money which is very careful about who is allowed to interact with that money. Only "owner"s are allowed to take privileged actions. You might already see where this is going: the proxy contract is an owner. There was some validation in place to prevent the obvious from happening, which makes this attack not exactly like what Rachel describes, but there was little enough validation that it's not uncharitable to say the hacker simply asked for all the money (root) and the smart contract happily complied. [1] https://www.rekt.news/polynetwork-rekt/ https://www.rekt.news/polynetwork-rekt/