Ronin network is explained in detail by the black picture of $610 million "where to go"

Certik Chinese community 2022-04-04 17:23:40 阅读数:961

ronin network explained black picture

In hindsight Money vanishing

In the world of encryption , Private key management and maintaining private key security , Has always been an important topic .

In recent days, , The most popular at the moment NFT game Axie Infinity Side chain Ronin Network Hacked , Cause a value of about 6.1 A billion dollars of cryptocurrency was stolen . The attacker stole 17.36 over ETH as well as 2550 over USDC.

It is worth mentioning that , The attack occurred on 3 month 23 It happened on the th , however 5 Days later, it was unable to extract due to user report 5000 ETH And found the attack .

Axie Infinity Is a Pokemon like game , Players can earn cryptocurrency in the game ;Ronin Network Is to achieve high Transactions Per Second (TPS) And let users have a smoother game experience to develop the side chain ;Ronin Bridge Assist in the transfer of cryptocurrency into and out Ronin Network; They all belong to Sky Mavis operating .

Verify that the node is lost

To identify deposit and withdrawal Events ,Ronin Five of the nine verification nodes need to be verified . And the attacker hacked 4 individual Sky Mavis The private key , made 5 A legal signature , namely :4 individual Sky Mavis Verifier and 1 individual Axie DAO Signature generated by a running third-party verifier .

Sky Mavis After your private key was compromised , Attackers use signatures to create “ Withdrawal certificate ”. And after the vulnerability occurs ,Sky Mavis It has been decided to increase the required verification node signature to 8 individual .

Although node verification has been decentralized , But hackers found out gas-free RPC A back door .

As early as 2021 year 11 Once a month Axie DAO In the activity ,Axie DAO Given Sky Mavis Authority to sign transactions on its behalf . However, the permission has not been revoked later .

namely : Once the attacker obtains Sky Mavis Access rights of , You can pass gas-free RPC get Axie DAO The signature of the .

6 Billion dollars “ Where to go ”

Here it is , CertiK utilize CertiK Skytrace Summed up a capital flow direction chart :

EvuM18GzUixHEcapDmCVrJnirsyRHlGrWSo8YSBB.png

Summary and Suggestions

This incident was caused by mismanagement of the private key .

CertiK Users and project parties are reminded of the importance of managing private keys .

Sky Mavis Multi sign off is applied in the project to avoid single point of failure , This is a major advance in security . Multi signing refers to the need for multiple keys to authorize transactions , Instead of a single signature of a key .

However, the authority granted during the early activities has not been revoked , So that hackers can take advantage of . Therefore, it is very important to remember to revoke the permission list and whitelist access after the event or function is completed .

Reference link :

https://roninblockchain.substack.com/p/community-alert-ronin-validators?s=w 

https://rekt.news/ronin-rekt/

版权声明:本文为[Certik Chinese community]所创,转载请带上原文链接,感谢。 https://netfreeman.com/2022/03/202203311052444599.html