Partnered With:

Qubit project QBridge was hacked and $80 million was missing

Read this article in 7 Minutes

The SlowMist security team analyzed the attack on the QBridge of the Qubit project

Original title: "80 million US dollars disappeared - a brief analysis of QBridge being hacked"

Original source: Slow Mist Technology

< p>According to the intelligence of Slow Mist District, on January 28, 2022, the QBridge of the Qubit project was attacked, causing a loss of about 80 million US dollars. The SlowMist security team conducted an analysis and shared it with you in the form of a brief analysis.

A brief analysis

1. The attacker conducts a deposit operation through the QBridge contract on ETH, and passes in the destinationDomainID of the target chain to be crossed, the asset resourceID of the Data composed of parameters such as the amount of chain funds and the receiving address.

2. The attacker specifies that the incoming resourceID is the value required across ETH Token, but It calls the deposit function of QBridge instead of the depositETH function, so it first bypasses the check of the amount of cross-chain funds and msg.value. The deposit function will take out the handler address from the mapping according to the resourceID to recharge. Since the attacker passes in the value required by the real cross-ETH Token, the deposit function of the handler contract can be successfully called.

3. In the deposit function of the handler contract, the Token to be recharged will be taken out according to the resourceID. Check in the whitelist. Since the resourceID passed in by the attacker corresponds to ETH, the Token to be recharged out of the mapping is 0 address, which will be considered as recharging ETH and passed the whitelist check. However, the deposit function did not check the Token address to be recharged again (recharging ETH should be cross-chain through the depositETH function), and then directly called the transferFrom function of the Token to be recharged through safeTransferFrom.

4. Since the Token address to be recharged is 0 address, and the call calls the one without code size For the EOA address, the execution result will be true and the return value will be empty, so the transfer operation through transferFrom passes the check of safeTransferFrom, and finally triggers the Deposit cross-chain recharge event.

5. Since the incoming resourceID is the value required across ETH, the triggered Deposit The event is the same as the real recharge of ETH, which makes QBridge think that the attacker has carried out ETH cross-chain, so a large number of qXETH Tokens are minted for the attacker on the BSC chain. The attacker used this qXETH credential to drain Qubit's lending pool.

MistTrack Analysis

SlowMist AML's MistTrack anti-money laundering tracking system analysis found that the attacker's address (0xd01...5c7) first obtained initial funds from Tornado.Cash withdrawals, and then The contract is deployed, and the address of the attacker's address interaction is the contract address of Qubit, PancakeSwap and Tornado.Cash. No further transfers of funds have occurred at this time. SlowMist AML will continue to monitor the transfer of stolen funds, block wallet addresses controlled by attackers, and remind exchanges and wallets to pay attention to strengthening address monitoring to prevent related malicious funds from flowing into the platform.

Summary

< br>

The main reason for this attack is that the tokens in the whitelist are During the transfer operation, whether it is 0 address was not checked again, which resulted in the recharge operation that should have been recharged through the native recharge function, but it can smoothly go through the normal Token recharge logic. The SlowMist security team recommends checking whether the recharged token is a native token after performing a whitelist check on the recharged token.

Reference transaction:

https://etherscan.io/tx/0x478d83f2ad909c64a9a3d807b3d8399bb67a997f9721fc5580ae2c51fab92acf

https://bscscan .com/tx/0x33628dcc2ca6cd89a96d241bdf17cdc8785cf4322dcaf2c79766c990579aea02