Security alert behind 20 million OP theft: A mistake any oversigned wallet user could make
Kelvin Fichter is an Ethereum developer
On June 9, Optimism announced on social media that 20 million OP's have now been taken over by hackers due to communication and technical missteps in a partnership with cryptocurrency market maker Wintermute. At first, the Optimism Foundation sent 20 million OP to Wintermute for market making. Later, Wintermute realized that the address it provided was Layer1. Before Wintermute switched to Layer2, The attacker has preempted it by deploying it with different initialization parameters. So far, hackers have sold about 1 million stolen OP.
In response, Ethereum developer Kelvin Fichter explained why the vulnerability was attacked, saying that smart contract accounts are different from EOA. Regular EOA users can access accounts in any EVM chain, but smart contract accounts cannot. The following is a transcript from Kelvin Fichter on social media.
It is important to note that this event is not the result of any vulnerabilities in Optimism or Gnosis Safe, but rather of (reasonable) security assumptions made in older versions of Gnosis Safe.
Older versions of Gnosis Safe factory contracts were deployed through transactions without chain ids (non-IP -155 transactions). This means that these transactions can be reset on a chain other than Ethereum. In some ways, this is really useful. This means that the same factory can be deployed to the same location on each chain. As now the factory is deployed to Optimism.
Unfortunately, when using this older factory contract, the Gnosis Safe UI sometimes uses the createProxy function, which creates multiple signatures through CREATE instead of CREATE2. Unlike CREATE2, the contract address created by CREATE is not based on the code used to CREATE the contract, but only on the nONCE of the creator's address. This means that an attacker can deploy the old Safe factory to Optimism and start retriggering the createProxy function to create multiple signatures on L2.
However, because createProxy uses CREATE instead of CREATE2, an attacker is able to initialize these multiple signatures so that they are owned by the attacker.
Users generally assume that any account they can access on Ethereum can also be accessed on other EVM-based chains. This is usually true for EOA accounts (also known as non-contractual accounts). But that doesn't necessarily apply to smart contract accounts. Contracts can be created at the same address on different chains using completely different code, resulting in completely different owners.
Misunderstandings like this can have serious consequences in the real world. Last week Wintermute accepted a loan of 20 million OP tokens to lend the L1 multi-signature wallet they believe is accessible on L2. This L2 address was one of the multiple signatures later deployed by the attacker.
These are the growing pains of a multi-chain world. Unfortunately, it underscores the importance of designing systems for multi-chained users. CREATE2 and deterministic deployment are critical, especially for contract wallets.
If you are using a multi-signed wallet on Ethereum, I highly recommend that you take the time to understand the security attributes of your wallet and whether you will control that wallet on a chain other than Ethereum.
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
Related Articles
