Partnered With:

Slow fog: Furucombo was hacked and analyzed

Read this article in 10 Minutes

To avoid overauthorization, DEFI has a long way to go in terms of security.

Original source: Daily Planet

慢雾：Furucombo被黑分析

According to the chain news, famousDeFiProject Furucombo was hacked and lost more than $15 million.Slowly the mistsecurityteamFirst time intervention analysis, and will attack details to share with everyone.

Attack detail analysis

The contract in question is in Furucombo's own agency contract. The whole attack process is simple. By setting the logical address of Furucombo's AAVEV2 Proxy, the attacker causes all subsequent logic calls through the Furucombo Proxy contract to be forwarded to the attacker's own malicious contract, resulting in the theft of any funds.

慢雾：Furucombo被黑分析

But if things were that simple, this analysis would be trivial. The problem is far more complicated than imagined.

As shown in the figure above, the attacker's entrance is in the batchExec function of Furucombo. First, we analyze the batchExec function:

慢雾：Furucombo被黑分析

The above is the specific implementation of the BatchExec function of Furucombo Proxy contract, in which the _preProcess and _postProcess contract respectively do some data processing before and after the call, and do not involve the specific call logic, so you can ignore it here. We'll focus on the core _execs function:

慢雾：Furucombo被黑分析

Through the analysis of the code for execs, it is not difficult to find that the main logic of the function is to check the data in configs array and process data according to the data in configs array. However, looking back at the attacker's invocation data above, it is not difficult to find that in the attacker's invocation data, the data in configs is a 0 address:

慢雾：Furucombo被黑分析

There is a trick here, because The 0 address is an EOA address, and all function calls to the EOA address will succeed, but will not return any results. With this trick, the part of the function execs that contains the configs data can be ignored for now. Go straight to the final core _exec function:

慢雾：Furucombo被黑分析

The logic of the _exec function is also very simple. After verifying the _to address, the data is forwarded directly to the specified _to address. And through the analysis of the attack transaction, we can find that this _to address is indeed the official designated legal address.

慢雾：Furucombo被黑分析

The last step is to call the _to address, which is the initialize function of the AAVEV2 Proxy contract officially designated, to set the attacker's own malicious address to the logical address of the AAVEV2 Proxy contract. Through the analysis of the Furucombo contract, it can be found that there is no serious security point in the whole call process, and the address of the call has also been checked by whitelist. The only problem is the logic of the Proxy being invoked, namely the AAVEV2 Proxy contract.

We directly analyze the logic of the initialize function of the AAVEV2 Proxy contract:

慢雾：Furucombo被黑分析

You can see that the initialize function is a public function, and at the beginning checks whether the _implpentation address is 0, and if it is, an error is thrown. The purpose of this check is really to check whether the _implpentation is set, and if it is, it can't be set again. Based on this setting, it's not hard to figure out that initialize can only be called once. Unless AaveV2 Proxy never sets _implpentation, this call will not succeed. Doesn't Furucombo really set the corresponding _implpentation? With this question in mind, we examine the state changes within the transaction. As follows:

慢雾：Furucombo被黑分析

As you can see, the deal has changed the content of the storage location of 0 x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc, and written content is their malicious attackers contract address & have spent0x86765dde9304bea32f65330d266155c4fa0c4f04.

While & have spent 0 x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc this position, it is _implpentation data memory address.

慢雾：Furucombo被黑分析

In other words, it was never officially set up. The _implpentation address of the AaveV2 Proxy contract causes the attacker to drill this void, resulting in a loss of the Furucombo asset.

conclusion

From the analysis of the whole event,Furucombo's accident is not considered a security breach, mainly because the official will not be used. The AAVEV2 Proxy contract is added to its own whitelist, and the AAVEV2 Proxy contract is not initialized, which gives the attacker an opportunity to take advantage of it.

advice

At the moment, the Furucombo attack, will cause any tokens authorization give Furucombo contracts (0 x17e8ca1b4798b97602895f63206afcd1fc90ca5f) users will face the risk of losing the money.

The Slow Fog Security team recommends that users who have interacted with Furucombo check to see if they have licensed the relevant token to the Furucombo contract. If authorized, the relevant authorization should be revoked in time to avoid further losses.

Reference link:

Token authorization check address:https://approved.zone/

Attack trading:

https://ethtx.info/mainnet/0x6a14869266a1dcf3f51b102f44b7af7d0a56f1766e5b1908ac80a6a23dbaf449