Sam Eiderman (sameid.eef)

CTO @ Utila

Opinions are mayo

[Sam Eiderman (sameid.eef) @_eiderman]

Before I go in depth to explain the booster rocket stage of the Durable Nonces and how some architectural design of this feature played a crucial part in the exploit, I would just like to bring attention to the fact that wallet software should do more and invest more in the display of the transactions being signed. If you can’t read the “fine print” of the transaction payload you are signing - might as well just sign with your eyes closed.

Read more on our blog:
https://t.co/lvB423tRFJ

Stay safe

[Sam Eiderman (sameid.eef) @_eiderman]

🚨 Drift Protocol on Solana - Compromised, 250M$ Stolen 🚨

Statement from Drift:

"Earlier today, a malicious actor gained unauthorized access to Drift Protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drift’s Security Council administrative powers.

This was a highly sophisticated operation that appears to have involved multi-week preparation and staged execution, including the use of durable nonce accounts to pre-sign transactions that delayed execution."

[Sam Eiderman (sameid.eef) @_eiderman]

A quick recap of the Bybit hack to show the remarkable resemblance.

Bybit’s treasury, secured by a multi-sig account (Gnosis Safe), on Ethereum - hacked ($1.4B) by compromising the Gnosis Safe UI, delivering an obfuscated payload instead of a legitimate transaction to signers - the transaction looked like a regular transfer, but was in fact reassigning the ownership of the entire Safe to the attacker. This was amplified by the use of an “advanced feature” of the Gnosis Safe. The use of this advanced feature probably went unnoticed by the signers, most likely because the wallet software did not emphasize it (link in comments for previous post).

Now, Drift’s treasury, secured by a multi-sig account (Squads), on Solana - hacked by making 2 out of the 5 Squads admins sign a transaction that reassigned the ownership of the entire Squads mutil-sig to the attacker. This was amplified by the use of an “advanced feature” of Solana - Durable Nonces. And again, the use of this advanced feature probably went unnoticed by the signers, again - most likely because the wallet software did not emphasize its usage.

[Sam Eiderman (sameid.eef) @_eiderman]

@YaelSherer בינתיים כל העכבישים עזבו לי את הבית

[Sam Eiderman (sameid.eef) @_eiderman]

@YaelSherer זה נכון גם לביצי תרנגולות שקרפדה דגרה עליהם?

[Sam Eiderman (sameid.eef) @_eiderman]

IMO this is an insecure design choice by the @safe team, `operation` should have never been a parameter to execTransaction method but should have been moved to its own execDangerousTransaction method to avoid UI/phishing attacks.

[Sam Eiderman (sameid.eef) @_eiderman]

Holy sh!t

@safe multisig simulations are hard, especially when done in STDv4 setting, in those cases simulators should use the embedded `to`, `value` and `data` parameters - a zero value transfer(address,uint256) in this case - no simulation effects even, HOWEVER...

[Ben Zhou @benbybit]

Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change the smart contract logic of our ETH cold wallet. This resulted Hacker took control of the specific ETH cold wallet we signed and transfered all ETH in the cold wallet to this unidentified address. Please rest assured that all other cold wallets are secure.
All withdraws are NORMAL.

I will keep you guys posted as more develops, If any team can help us to track the stolen fund will be appreciated.
https://t.co/ckwZgma8Lf

[Sam Eiderman (sameid.eef) @_eiderman]

There's only one thing worse than "no simulation" and that's "wrong simulation", I wonder how many wallets that simulate Safe's contract calls, flag contract calls with "operation = 1" as a parameter (instead 0).

This was literally a one bit attack.

🤯

[Sam Eiderman (sameid.eef) @_eiderman]

@LindellYehuda I agree, it's a purist approach

The alternative from UX perspective is to tell users: "just keep those keys somewhere less safe forever", which is always worse.

Better to allow import and set "imported: true; attestation: null"

[Sam Eiderman (sameid.eef) @_eiderman]

@LindellYehuda I agree, it's a purist approach

The alternative from UX perspective is to tell users: "just keep those keys somewhere less safe forever", which is always worse.

Better to allow import and set "imported: true; attestation: null"

[Sam Eiderman (sameid.eef) @_eiderman]

Now can someone explain to me how USDT, the most popular stablecoin, does not get upgraded to support such capabilities as well...

[Sam Eiderman (sameid.eef) @_eiderman]

UPDATE:

PYUSD now migrated from betaDelegatedTransfer to transferWithAuthorization - consolidating the capabilities offered by USDC - a small win for standardization.

Even added transferWithAuthorization[Batch] to making batching simpler and not use an external contract.

[Sam Eiderman (sameid.eef) @_eiderman]

PayPal's PYUSD

For some reason, they implemented their own betaDelegatedTransfer[Batch] for gasless transfers instead of just implementing a 3-years old EIP-3009 - TransferWithAuth which does not use nonces

I would rather pay for that extra memslot than use nonces.

[TON 💎 @ton_blockchain]

Secure, seamless, and institutional-grade staking is now more accessible on TON with @utila_io

[hinkal @hinkal_protocol]

We're excited to have @utila_io and @Protokols_io at our X Spaces 📡
Pre-save the link for tomorrow! 👇 https://t.co/JTE2GUixac

[hinkal @hinkal_protocol]

Get ready for our X Spaces with @utila_io, save the link for tomorrow!

👉 https://t.co/7u90KacToD

@Protokols_io will also join our discussion on privacy in DeFi and the Hinkal Lords Challenge 🗣️

PS: You can learn more about the challenge from @prz_chojecki's video! Click ⤵️

[Sam Eiderman (sameid.eef) @_eiderman]

@ZacharyDeWitt 😍

[Sam Eiderman (sameid.eef) @_eiderman]

PayPal's PYUSD

For some reason, they implemented their own betaDelegatedTransfer[Batch] for gasless transfers instead of just implementing a 3-years old EIP-3009 - TransferWithAuth which does not use nonces

I would rather pay for that extra memslot than use nonces.

[Sam Eiderman (sameid.eef) @_eiderman]

נשמה זה לא אני פוסל אותך
אלו הם חוקי הפרומפט