Certik Chinese community 2022-04-04 17:23:40 阅读数:961
In the world of encryption , Private key management and maintaining private key security , Has always been an important topic .
In recent days, , The most popular at the moment NFT game Axie Infinity Side chain Ronin Network Hacked , Cause a value of about 6.1 A billion dollars of cryptocurrency was stolen . The attacker stole 17.36 over ETH as well as 2550 over USDC.
It is worth mentioning that , The attack occurred on 3 month 23 It happened on the th , however 5 Days later, it was unable to extract due to user report 5000 ETH And found the attack .
Axie Infinity Is a Pokemon like game , Players can earn cryptocurrency in the game ;Ronin Network Is to achieve high Transactions Per Second (TPS) And let users have a smoother game experience to develop the side chain ;Ronin Bridge Assist in the transfer of cryptocurrency into and out Ronin Network; They all belong to Sky Mavis operating .
To identify deposit and withdrawal Events ,Ronin Five of the nine verification nodes need to be verified . And the attacker hacked 4 individual Sky Mavis The private key , made 5 A legal signature , namely ：4 individual Sky Mavis Verifier and 1 individual Axie DAO Signature generated by a running third-party verifier .
Sky Mavis After your private key was compromised , Attackers use signatures to create “ Withdrawal certificate ”. And after the vulnerability occurs ,Sky Mavis It has been decided to increase the required verification node signature to 8 individual .
Although node verification has been decentralized , But hackers found out gas-free RPC A back door .
As early as 2021 year 11 Once a month Axie DAO In the activity ,Axie DAO Given Sky Mavis Authority to sign transactions on its behalf . However, the permission has not been revoked later .
namely ： Once the attacker obtains Sky Mavis Access rights of , You can pass gas-free RPC get Axie DAO The signature of the .
Here it is , CertiK utilize CertiK Skytrace Summed up a capital flow direction chart ：
This incident was caused by mismanagement of the private key .
CertiK Users and project parties are reminded of the importance of managing private keys .
Sky Mavis Multi sign off is applied in the project to avoid single point of failure , This is a major advance in security . Multi signing refers to the need for multiple keys to authorize transactions , Instead of a single signature of a key .
However, the authority granted during the early activities has not been revoked , So that hackers can take advantage of . Therefore, it is very important to remember to revoke the permission list and whitelist access after the event or function is completed .
Reference link ：
版权声明：本文为[Certik Chinese community]所创，转载请带上原文链接，感谢。 https://netfreeman.com/2022/03/202203311052444599.html