4 ms·

The actual exploit (simplified for brevity): if (validSignature == signatureFromGuardian) approve() If you send an invalid signature from a non-gu

by dannyw 5y ago

The actual exploit (simplified for brevity): if (validSignature == signatureFromGuardian) approve() If you send an invalid signature from a non-guardian, the condition also resolves to true..

randomhodler84 5y ago
It’s more than this no? I think the attacker substituted their own ECDSA verify function contract because the load call didn’t check it was the system verifier?
- kristjansson 5y ago
  Seems like it accepted a point to the verification function from the thing it was supposed to be verifying?
- can16358p 5y ago
  Isn't it in line with what the parent comment said? (Though in a simpler manner)
  - deleted 5y ago
    [deleted]
deleted 5y ago
[deleted]
T0Bi 5y ago
That's simply wrong. Stop copying random stuff from Twitter. Several others here have explained how the attack actually happened.