Thorchain publishes some of the details of the attack and the solution

According to BlockBeats news, on July 16, Thorchain confirmed on Twitter that it was attacked. At this stage, it expects to lose up to 4,000 ETH, and the team will compensate the affected users.  

  Later, Thorchain officially announced the details of some of the attacks and the solution. Thorchain launched "ChaosNet" in April to facilitate cross-chain transactions between BTC, ETH, LTC, BCH and BSC networks. Defi Watch founder Chris Blec says Thorchain's phased "cap increase" has prevented even greater capital losses.

These were attacked because ETH Bifrost recently completed an upgrade that allows routing nodes to wrap tokens with contracts for cross-chain compatibility. The attacker then used a custom wrapper contract to fake a transfer transaction to Bifrost without actually making a transfer containing a real amount, i.e., the amount transferred was all 0ETH.  

An attacker could send a transaction code with msg.value = 200 ETH, but then use a custom contract to transfer it back to him, and then invoke the router with a deposit amount of 0. After doing this, Bifrost will report msg.value = 200 and will not find DepositAmount = 0.  

  The team's current solution is:  

1. Launch the upgrade patch, restart the network, cancel pending transactions, and restore solvency;  

2. Donate funds back to the ETH pool and compensate the lost funds to the ETH liquidity provider (LP);  

3. Release automatic settlement monitor;  

4. Work with security companies to conduct audits.    

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia