4 ms·
Excerpt explaining the exploit: "Preliminary analysis from CertiK shows that the attacker exploited a vulnerability on the solana side of the Wormhole bridge t
by gzer0 5y ago
Excerpt explaining the exploit:
"Preliminary analysis from CertiK shows that the attacker exploited a vulnerability on the solana side of the Wormhole bridge to create 120,000 so-called “wrapped” ethereum tokens for themselves. (Wrapped etherum tokens are pegged to the value of the original coin but are interoperable with other blockchains.) It appears that they then used these tokens to claim ethereum that was held on the ethereum side of the bridge.
Prior to the exploit, the bridge held a 1:1 ratio of ethereum to wrapped ethereum on the solana blockchain, “acting essentially as an escrow service,” according to CertiK.
“This exploit breaks the 1:1 peg, as there is now at least 93,750 less ETH held as collateral,” continued the report."
- dannyw 5y agoThe actual exploit (simplified for brevity): if (validSignature == signatureFromGuardian) approve() If you send an invalid signature from a non-guardian, the condition also resolves to true..
- randomhodler84 5y agoIt’s more than this no? I think the attacker substituted their own ECDSA verify function contract because the load call didn’t check it was the system verifier?
- kristjansson 5y agoSeems like it accepted a point to the verification function from the thing it was supposed to be verifying?
- can16358p 5y agoIsn't it in line with what the parent comment said? (Though in a simpler manner)
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- T0Bi 5y agoThat's simply wrong. Stop copying random stuff from Twitter. Several others here have explained how the attack actually happened.