3 ms·

> The Axie DAO allowlisted Sky Mavis to sign various transactions on its behalf. This was discontinued in December 2021, but the allowlist access was not revoke

> The Axie DAO allowlisted Sky Mavis to sign various transactions on its behalf. This was discontinued in December 2021, but the allowlist access was not revoked. Once the attacker got access to Sky Mavis systems they were able to get the signature So a question remains of how the attacker got access to Sky Mavis systems? > A security audit likely would have identified an inherent problem in the majority of the multisig keys being stored on a single server. There was no security aduit? Can anyone more familiar with this project add context?

woah 4y ago
The context here is that Axie was using a "proof of authority" blockchain, which is controlled by a predetermined set of signers. This is already very bad because it makes them a custodian of the money on the chain. Worse, they used it in a very insecure way where they held a majority of the keys on one server. So, not only did they call an effectively centralized server a "blockchain", they also acted deceptively about the number of centralized custodians on that multisig, by pretending there were 9 entities when there was only one. Most likely, the underlying code was audited as being secure when used by a larger group of independent validators. If there were 20, it would be very hard to compromise them all. The code that was broken was probably some other dumb utility on the server that got hit by a regular privilege escalation vulnerability or something.
- nscalf 4y ago
  Spot on. They said they're increasing the number of validators, but ultimately the biggest issue with how they implemented this was that they put so many multisig keys in the same spot. They could have 100,000 validators, if 50,001 multisig keys are on their server, and they need a simple majority, it's just as vulnerable. They did say that they are expanding the amount of individual entities holding multisig keys, so they seem to realize this was a bad idea.

woah 4y ago

The context here is that Axie was using a "proof of authority" blockchain, which is controlled by a predetermined set of signers. This is already very bad because it makes them a custodian of the money on the chain. Worse, they used it in a very insecure way where they held a majority of the keys on one server. So, not only did they call an effectively centralized server a "blockchain", they also acted deceptively about the number of centralized custodians on that multisig, by pretending there were 9 entities when there was only one. Most likely, the underlying code was audited as being secure when used by a larger group of independent validators. If there were 20, it would be very hard to compromise them all. The code that was broken was probably some other dumb utility on the server that got hit by a regular privilege escalation vulnerability or something.

nscalf 4y ago
Spot on. They said they're increasing the number of validators, but ultimately the biggest issue with how they implemented this was that they put so many multisig keys in the same spot. They could have 100,000 validators, if 50,001 multisig keys are on their server, and they need a simple majority, it's just as vulnerable. They did say that they are expanding the amount of individual entities holding multisig keys, so they seem to realize this was a bad idea.