EthPow under attack – Last week, the protocol Ethereum transitioned from Proof of Work to Proof of Stake. At the same time, some miners decided to create a fork of Ethereum which would keep the PoW titled EthereumPow. However, it only took a few hours for attackers to exploit a flaw.
A first attack on EthereumPow (ETHW)
September 15 was a historic day for the Ethereum network. Indeed, the long-awaited update The Merge has been deployed on the mainnet after several months of intensive testing. This marks the definitive abandonment of Proof of Work as a type of consensus, in favor of Proof of Stake.
However, a coalition of miners not wanting see their livelihood disappear decided to fork the chain. The goal is to maintain a version of the network using Proof of Work, which pays miners.
As soon as it was released, the overwhelming majority of users decided to massively sell their ETHW tokens, resulting in a significant drop in price.
At the same time, other malicious users explored the presence of potentially exploitable flaws. Unsurprisingly, it only took a few hours for the first fault be discovered.
Thus, on September 18, the company BlockSecspecializing in blockchain security, publicly warned the community that an attacker had managed to exploit a flaw in one of the protocols deployed on EthereumPow.
“BlockSec detected that attackers successfully replayed the PoS chain message (calldata) on EthereumPow. »
>> Play it safe, register on FTX the reference of crypto exchanges (commercial link) <<
ChainId: the blockchain identifier
Shortly after the alert was posted on Twitter, BlockSec teams posted a blog post returning to the details of the attack.
The latter explain that they detected the attack on September 16. Directly after detecting the attack, the BlockSec team notified the EthereumPow team.
Before going into the details of this attack, we must come back to ChainIds. Each blockchain using a similar code to that of Ethereum has its own identifier called ChainIdas explained by Consensys:
“Chain ID, or ChainId, is a node-managed property of the chain. It is used for transaction replay protection. Setting the chain ID has the effect of changing one of the parameters of a transaction. »
the “ replay » allows you to duplicate the same transaction on both blockchains.
the Ethereum ChainId in Proof of Stake is 1 and that of EthereumPow is 100001.
Explanation of the flaw
As you will have understood, the attacker took advantage of this property which is the ChainId to exploit the cross-chain bridge Omni Bridge.
To do this, the attacker transferred 200 WETH through the Omni Bridge of the Gnosis Chain. He then replayed the same message on the EthereumPow chain, allowing him to earn an additional 200 ETHW.
This maneuver was possible because the Omni Bridge code deployed on the EthereumPow chain used Ethereum’s ChainId in Proof of Stake and does not perform the verification correctly ChainId for cross-chain messages.
Therefore, the Omni Bridge did not detect that the user had replayed the same transaction on the EthereumPow network. The bridge then deemed it valid and the user was able to extract 200 ETHPow of the contract.
” The direct impact is that the attacker(s) could harvest a lot of ETHW and trade it on certain exchanges (e.g. certain CEX). In doing so, the price of ETHW could be affected due to the increase in liquidity. »
As highlighted by BlockSec, this flaw is likely present on other DeFi protocols, which do not properly perform ChainId verification.
In parallel, other forks of Ethereum have emerged after the deployment of The Merge. In addition to Ethereum Classic and EthereumPow,a new channel titled Ethereum Fair has emerged.
Stay away from spammers and scammers. Avoid too-good-to-be-true offers like the plague and get into the habit of being healthy with suspicion. On the other hand, also learn to place reasonable trust in respectable and recognized players in the ecosystem. The FTX platform falls without a shadow of a doubt into this second category. Come acquire and trade your first bitcoins and other cryptocurrencies. Register on FTX. You will benefit from a lifetime discount on your transaction fees (commercial link).
