The project party suffered a lightning loan attack on October, and the loss was about USD 10,000. This incident was analyzed technically and the security precautions were summarized. I hope that the follow-up projects can take it as a warning to build a security line for the blockchain industry. An attack transaction analysis: The attacker's brief description is the attack contract brief description is the attacker's attack contract. The attack on the attacked target contract includes a transaction. Take the first attack transaction as an example. The attack process is as follows: Read the address brief description as all the collateral and debts in the target contract. The return results are as follows. In the target contract, the collateral has a total debt. The attacker calls the function parameter in the debt contract by attacking the contract and sets it to all the debts queried above. Then, the function in the function will be called to repay all the original debts by lightning loan, and then a certain amount of collateral will be mortgaged again and a certain amount of debts will be borrowed. Among them, a function function is mainly called to repay the debts and extract all the collateral from here, which is the contract function. Re-mortgaging into the consolidated debt can be seen from the above data that the amount of collateral belonging to the address still remains after the function is executed, which is about the amount of collateral that the attacker borrowed from the contract through lightning loan, and then mortgaged and borrowed the debt and added the total debt, which is similar to the steps of calling the function in the debt contract. The parameters here are still set to all the debts after the last pledge, that is, the function in the function will be called, and then the sum function will be called, but the parameters in the sum function here are no longer. The above address is the pledged attack contract function to repay the debt and extract all the collateral from here, which is still a contract. At this time, there are functions to re-mortgage almost all the collateral into the debt. In fact, the collateral here does not belong to the attack contract, but belongs to the above address. Finally, the attacker called the function separately through the attack contract to extract the mortgage into the attack contract. After repaying the lightning loan, the attacker still made a profit. The root cause of this incident is the existence of the project contract. In the logic and authority verification, the attacker can use this vulnerability to obtain the pledged assets of other account addresses. What the attacker finally gets is the collateral whose original address is in the contract. The function of the contract defines the parameters of the contract and transforms it into the collateral that attacks the contract, and then extracts it. The attacker manipulates the mortgage and extraction function of other account addresses through the function in the contract and the function in the contract, because there is a lack of verification of the parameter address. There is collateral, so it is necessary to check the address in the credible check function, because the sum function is an operational asset, so it is necessary to check the increase of authority. In addition to the check of these two address parameters, it may also be necessary to check the quantitative parameters and implementation logic in the function. Third, security suggestions. For this attack, we should follow the following precautions in the development process. The project should maintain the integrity and rigor of logic in the design and development process, especially involving In the process of transferring assets, it is necessary to strengthen the verification of function research authority to ensure that the caller calls function parameters, transfer logic and so on are safe and credible. Before the project goes online, it is necessary to find a professional third-party audit team to conduct contract audit. The vision is to protect the world's security team, which is composed of experienced security professionals and senior researchers from all over the world. They are proficient in blockchain and intelligent contract underlying theory, and provide services including risk identification and blocking, intelligent contract audit chain analysis and so on. And built an intelligent risk identification and blocking platform on the chain, which can effectively fight against the world's advanced persistent threats, and has established long-term cooperative relations with key participants in various fields of ecology, such as official website. 比特币今日价格行情网_okx交易所app_永续合约_比特币怎么买卖交易_虚拟币交易所平台

注册有任何问题请添加 微信：MVIP619 拉你进入群

文章转载注明 网址：https://netpsp.com/?id=58436