Explore Web3 security guidelines from a stolen wallet case
The original title: "the technology | from a purse stolen case, discuss the safety guide Web3
原文来源：微信公众号： 阿法兔研究笔记
Written by Chris Afar Rabbit
The event
One morning during the New Year's holiday in 2022, Little C was ready to write code to continue testing Web3js for on-chain contract transactions. Suddenly, I found that my test account (Bsc chain) was zero in MetaMask, and THERE was 100USD in my account the night before, then I checked the transfer and found:
The money's gone. Where's the money?
background
Technical background of small C, recently in learning blockchain development. As a professional developer himself, HE has been very careful, and usually runs on the test network. After running, he will deploy on the formal network. However, he does not realize that the whole industry is still in a relatively chaotic stage.
How was the damage done?
On the last day of 2021, little C came across an account that was interesting (it had a lot of active trading), tracked some of his on-chain transactions, came across a very interesting item (with a very high annualized return), and magically connected to his MetaMask, I then magically approve, because this is normally the process for Web3 projects, approve and the transfer ends.
However, a shocking scene occurred: after clicking the button, the site suddenly froze (in fact, during the period of the blockage, the thieves moved the money away). Without any response, C ignored the site and shut it down to do something else.
About a day later, when Little C came back for development, he found that all the money in the account was gone. He checked the historical records and found that all the balance in the account had been transferred.
Review process
How did the thieves get all the money out of Little C's account?
What you see: If you approve, you can theoretically transfer all of your money without a private key.
Little C traced back to the source, probably because there was a problem with approve of a phishing website, so he traced back the transfer record.
As you can see in the figure, approve first approves a contract that authorizes the phishing contract to operate on BUSD in an account with no limit on the number of operations.
为什么会是 BUSD 呢？小 C 回忆了一下，一进入这个钓鱼站点是默认选了 BUSD ，估计在浏览站点链接钱包之后，盗取者就已经筛选了出了账号里面钱最多的 token 了。
Then, when C thought that this was a new swap contract with a high annual income and was ready to try it first, he would approve it according to the conventional procedure. When approve finished, the website froze.
Then, in retrospect, about a few seconds after the authorization, the contract triggered a direct transfer of the BUSD token.
Then I went to look up the authorization
Basically, MetaMask's default authorization is:
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
When we convert this to numbers, we know 1.157920892373162 times 10 to the 59. Basically, it can be understood as unlimited transfer, that is, this authorized operation allows this contract to manipulate the token of my account unlimited. When I saw this, I felt a chill behind my back, because I had clicked on Approve many times before and never looked at it.
The hacker then manipulates a wallet address that controls the contract method and initiates the contract transfer method, transferring the money. So after the friendsBe careful when clicking on Metamask authorization.
Small C checked, the thief now probably has 3W DOLLARS of tokens in this account, there are still a steady stream of victims in the transfer of money. But in the face of blockchain there is no way to find out who the hacker is.
The part that went wrong
What went wrong?
Because I've been studying blockchain. Small C about the logic of this fishing way, harm the heart can not have, the heart can not be free of people. You can learn about it if you are interested:
The normal transfer
Case 1: Transfer Between Users Transfer BUSD from user A to user B
The contract normally checks the following logic
1) Judge whether the account balance of user A has enough money; 2) Whether the transfer is initiated by user A
The process is shown below.
Normal contract exchange
Is the process when we usually use pancakeswap, UnisWAP and so on
Case 2: Token Exchange through Swap User A conducts A token exchange (BUSD for WBNB) process contract to judge:
1) Whether the balance of user A's account has enough BUSD (assuming that the swap contract has been authorized to operate the BUSDtoken of account A)
2) Swap contract take 500BUSD from account A and put it into the contract pool of swap (assuming the exchange rate is 1:500)
3) After success, the contract will be transferred to account A for 1BNB
Note points 2 and 3 that it is the contract control token that operates. That is to say, the contract can bypass us and directly initiate the operation of the tokens under our account.
Fishing contract
Let's look at the origin map
In a normal transfer, the transfer party and the transfer party executing the contract should be the same person, that is, the above figure (1) and (2) should be initiated by the same person. And this transaction THAT I was transferred to, those two are not at the same address. Presumably it was a wallet address control that executed the fishing contract and transferred the BUSD I authorized to the fishing contract.
To check the fishing contract, not surprisingly the fishing contract is an encrypted contract. But it's not too hard to think about it, as anyone who has done a bit of Solidity will know that when defining a contract you can just set up a few Admin's or Owner's.
Therefore, in the future, we must pay attention to the endorsement of the project side, and do not randomly authorize the project we do not know!!
Safety recommendations
Because of this, Little C searched for some useful advice and methods, but also saw a lot of bloody lessons.
So here's a list of some of the ways that you can do it based on your needs.
1) Don't share keys
A mnemonic word generates multiple accounts, which I do not recommend, because it is likely to be used in one pot.
2) The key is saved offline
Because there are many clipboard tool input methods that upload your clipboard record to the cloud, if you copy it, if the cloud leaks, your key is gone. My advice is to copy it into a notebook as soon as it's generated. Of course, you can also refer to my own dictionary encryption of keys, such as A with 1, B with 2, 1 with A, so that even if someone has access to your paper key, you can't touch your digital assets.
3) Separate development and test (airdrop and main account isolation)
Install two browsers, one chrome and one Brave. One to manage your main wallet. The other can be involved in picking up airdrops, various on-chain operations, etc
4) Don't download software from unknown sources
Don't use Baidu to download software of unknown origin. I saw a case that downloaded pirated Metamask and went bankrupt directly. Be sure to go to the regular address to download, conditional can refer to Google Play. The chrome web store, etc
5) Check your authorization immediately
Check the website has the following several, Debank does not open source, but UI interaction is better, the follow-up has open source, you choose.
https://debank.com/
https://approved.zone/
https://tac.dappstar.io/
https://ethallowance.com/
And as you can see, it's essentially infinite.
Every time you invoke MetaMask, be sure to look at the authorization. Don't mindlessly delegate the next step like I am doing now.
6) Confirm the security of the contract before authorization
https://www.slowmist.com/service-smart-contract-security-audit.html
You can use slow Fog's contract audit feature.
You can also see if the contract is open source, and if it is open source, you need to check whether the contract is scalable, etc.
7) Pay attention to safety when lifting air drops and welfare
Use small to get, do not use a large, authorization can be set up when the amount!!
8) Watch out for intrusions from social workers and strangers talking about you in private Discord
Take Discord or Telegram, for example. When someone knows you for a few days and offers to get you money to install the software they send you and log in, 99.99% of your money will go out of your pocket. The account is stolen.
In particular, if you go into NFT's official Discord, someone will talk to you privately and tell you that you've got a white list, along with a Mint link. The scammer will change his profile picture and name to the official one, in fact, he and you are a team to achieve this. In a few hours, mint, 1 to 10 mint. Mint one or two is not bad, this one up to 10 with a time limit.
In addition, there will be scammers who imitate the official website of the project to create a fake website and send private messages to the people in the project Server, asking them to come to Mint.
Another friend bought a fake NFT on OpenSea and later found it was not official. After a few days, the NFT disappeared from the account. However, it had been deducted. How did you find out? Look at the chain. There's an official Discord site called Opensea.)
And fake Collab. land spoofed wallet passwords, airdropped big V and claimed big V bought that NFT/token.
The New Year is coming, we must pay attention to safety ah, hope to see this article friends can be in peace and smooth!
Thanks to the author Chris,
Thanks to Free, namely Satoshi, JulzW, Big K Run ah, Ah Meng for the supplement.
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
Related Articles
