ETHW confirms contract vulnerability exploit, dismisses replay attack claims

Publish-Ethereum Merge proof-of-work (PoW) chain ETHW has moved to quell claims that it had suffered an on-chain replay assault over the weekend.

Sensible contract auditing agency BlockSec flagged what it described as a replay assault that came about on Sept. 16, through which attackers harvested ETHW tokens by replaying the decision information of Ethereum’s proof-of-stake (PoS) chain on the forked Ethereum PoW chain.

In response to BlockSec, the basis reason for the exploit was attributable to the truth that the Omni cross-chain bridge on the ETHW chain used previous chainID and was not accurately verifying the right chainID of the cross-chain message.

Ethereum’s Mainnet and take a look at networks use two identifiers for various makes use of, particularly, a community ID and a sequence ID (chainID). Peer-to-peer messages between nodes make use of community ID, whereas transaction signatures make use of chainID. EIP-155 launched chainID as a way to stop replay assaults between the ETH and Ethereum Traditional (ETC) blockchains.

1/ Alert | BlockSec detected that exploiters are replaying the message (calldata) of the PoS chain on @EthereumPow. The foundation reason for the exploitation is that the bridge would not accurately confirm the precise chainid (which is maintained by itself) of the cross-chain message.

— BlockSec (@BlockSecTeam) September 18, 2022

BlockSec was the primary analytics service to flag the replay assault and notified ETHW, which in flip rapidly rebuffed preliminary claims {that a} replay assault had been carried out on-chain. ETHW made makes an attempt to inform Omni Bridge of the exploit on the contract degree:

Had tried each technique to contact Omni Bridge yesterday.

Bridges must accurately confirm the precise ChainID of the cross-chain messages.

Once more this isn’t a transaction replay on the chain degree, it’s a calldata replay as a result of flaw of the precise contract. https://t.co/bHbYR4b2AW pic.twitter.com/NZDn61cslJ

— EthereumPoW (ETHW) Official #ETHW #ETHPoW (@EthereumPoW) September 18, 2022

Evaluation of the assault revealed that the exploiter began by transferring 200 WETH by means of the Omni bridge of the Gnosis chain earlier than replaying the identical message on the PoW chain, netting an additional 200ETHW. This resulted within the steadiness of the chain contract deployed on the PoW chain being drained.

Related: Cross-chains in the crosshairs: Hacks call for better defense mechanisms

BlockSec’s evaluation of the Omni bridge supply code confirmed that the logic to confirm chainID was current, however the verified chainID used within the contract was pulled from a worth saved within the storage named unitStorage.

The group defined that this was not the right chainID collected by means of the CHAINID opcode, which was proposed by EIP-1344 and exacerbated by the ensuing fork after the Ethereum Merge:

“That is in all probability attributable to the truth that the code is sort of previous (utilizing Solidity 0.4.24). The code works effective on a regular basis till the fork of the PoW chain.”

This allowed attackers to reap ETHW and probably different tokens owned by the bridge on the PoW chain and go on to commerce these on marketplaces itemizing the related tokens. Cointelegraph has reached out BlockSec to establish the worth extracted through the exploit.

Following Ethereum’s successful Merge event which noticed the good contract blockchain transition from PoW to PoS, a gaggle of miners determined to proceed the PoW chain by means of a tough fork.