• bitcoinBitcoin (BTC) $ 60,894.00
  • ethereumEthereum (ETH) $ 3,360.14
  • tetherTether (USDT) $ 0.999635
  • bnbBNB (BNB) $ 569.94
  • solanaSolana (SOL) $ 135.08
  • usd-coinUSDC (USDC) $ 1.00
  • staked-etherLido Staked Ether (STETH) $ 3,358.41
  • xrpXRP (XRP) $ 0.475163
  • the-open-networkToncoin (TON) $ 7.57
  • dogecoinDogecoin (DOGE) $ 0.122235
  • cardanoCardano (ADA) $ 0.389032
  • tronTRON (TRX) $ 0.121126
  • shiba-inuShiba Inu (SHIB) $ 0.000017
  • avalanche-2Avalanche (AVAX) $ 25.00
  • wrapped-bitcoinWrapped Bitcoin (WBTC) $ 60,973.00
  • chainlinkChainlink (LINK) $ 13.95
  • polkadotPolkadot (DOT) $ 5.77
  • bitcoin-cashBitcoin Cash (BCH) $ 373.66
  • uniswapUniswap (UNI) $ 9.37
  • nearNEAR Protocol (NEAR) $ 5.53
  • wrapped-eethWrapped eETH (WEETH) $ 3,494.10
  • leo-tokenLEO Token (LEO) $ 5.77
  • matic-networkPolygon (MATIC) $ 0.572242
  • litecoinLitecoin (LTC) $ 70.63
  • daiDai (DAI) $ 1.00
  • pepePepe (PEPE) $ 0.000012
  • fetch-aiFetch.ai (FET) $ 1.64
  • internet-computerInternet Computer (ICP) $ 8.07
  • kaspaKaspa (KAS) $ 0.153650
  • ethena-usdeEthena USDe (USDE) $ 0.999994
  • ethereum-classicEthereum Classic (ETC) $ 23.40
  • renzo-restaked-ethRenzo Restaked ETH (EZETH) $ 3,396.68
  • aptosAptos (APT) $ 6.88
  • moneroMonero (XMR) $ 163.45
  • render-tokenRender (RNDR) $ 7.69
  • hedera-hashgraphHedera (HBAR) $ 0.078707
  • cosmosCosmos Hub (ATOM) $ 6.94
  • arbitrumArbitrum (ARB) $ 0.822621
  • stellarStellar (XLM) $ 0.090456
  • okbOKB (OKB) $ 41.39
  • filecoinFilecoin (FIL) $ 4.37
  • mantleMantle (MNT) $ 0.755361
  • crypto-com-chainCronos (CRO) $ 0.090923
  • blockstackStacks (STX) $ 1.60
  • immutable-xImmutable (IMX) $ 1.54
  • injective-protocolInjective (INJ) $ 23.00
  • first-digital-usdFirst Digital USD (FDUSD) $ 0.999369
  • lido-daoLido DAO (LDO) $ 2.41
  • suiSui (SUI) $ 0.875359
  • the-graphThe Graph (GRT) $ 0.218347
  • vechainVeChain (VET) $ 0.025697
  • makerMaker (MKR) $ 2,239.53
  • optimismOptimism (OP) $ 1.74
  • arweaveArweave (AR) $ 29.48
  • bittensorBittensor (TAO) $ 273.93
  • rocket-pool-ethRocket Pool ETH (RETH) $ 3,732.08
  • dogwifcoindogwifhat (WIF) $ 1.86
  • ondo-financeOndo (ONDO) $ 1.20
  • fantomFantom (FTM) $ 0.593713
  • flokiFLOKI (FLOKI) $ 0.000170
  • mantle-staked-etherMantle Staked Ether (METH) $ 3,481.59
  • theta-tokenTheta Network (THETA) $ 1.56
  • bitget-tokenBitget Token (BGB) $ 1.10
  • based-brettBrett (BRETT) $ 0.149917
  • bonkBonk (BONK) $ 0.000022
  • notcoinNotcoin (NOT) $ 0.014194
  • jasmycoinJasmyCoin (JASMY) $ 0.030021
  • thorchainTHORChain (RUNE) $ 4.08
  • aaveAave (AAVE) $ 91.50
  • whitebitWhiteBIT Coin (WBT) $ 9.42
  • celestiaCelestia (TIA) $ 6.80
  • coredaoorgCore (CORE) $ 1.34
  • eosEOS (EOS) $ 0.573609
  • pyth-networkPyth Network (PYTH) $ 0.322995
  • algorandAlgorand (ALGO) $ 0.137260
  • sei-networkSei (SEI) $ 0.365135
  • quant-networkQuant (QNT) $ 75.11
  • jupiter-exchange-solanaJupiter (JUP) $ 0.778722
  • galaGALA (GALA) $ 0.028142
  • kelp-dao-restaked-ethKelp DAO Restaked ETH (RSETH) $ 3,388.35
  • flare-networksFlare (FLR) $ 0.023579
  • gatechain-tokenGate (GT) $ 7.63
  • flowFlow (FLOW) $ 0.626804
  • ethenaEthena (ENA) $ 0.550456
  • starknetStarknet (STRK) $ 0.716403
  • kucoin-sharesKuCoin (KCS) $ 9.72
  • zebec-protocolZebec Protocol (ZBC) $ 0.017947
  • axie-infinityAxie Infinity (AXS) $ 6.13
  • pendlePendle (PENDLE) $ 5.75
  • singularitynetSingularityNET (AGIX) $ 0.683707
  • bitcoin-svBitcoin SV (BSV) $ 44.42
  • tokenize-xchangeTokenize Xchange (TKX) $ 10.53
  • bittorrentBitTorrent (BTT) $ 0.00000086
  • dydx-chaindYdX (DYDX) $ 1.40
  • beam-2Beam (BEAM) $ 0.016349
  • elrond-erd-2MultiversX (EGLD) $ 29.71
  • neoNEO (NEO) $ 11.33
  • tezosTezos (XTZ) $ 0.782400
  • gnosisGnosis (GNO) $ 292.56
  • the-sandboxThe Sandbox (SAND) $ 0.329393
  • ordinalsORDI (ORDI) $ 35.53
  • msolMarinade Staked SOL (MSOL) $ 160.87
  • worldcoin-wldWorldcoin (WLD) $ 2.89
  • ether-fi-staked-ethether.fi Staked ETH (EETH) $ 3,358.64
  • usddUSDD (USDD) $ 0.997550
  • ethereum-name-serviceEthereum Name Service (ENS) $ 22.71
  • roninRonin (RON) $ 2.15
  • akash-networkAkash Network (AKT) $ 2.95
  • fasttokenFasttoken (FTN) $ 2.21
  • layerzeroLayerZero (ZRO) $ 2.75
  • chilizChiliz (CHZ) $ 0.077362
  • coinbase-wrapped-staked-ethCoinbase Wrapped Staked ETH (CBETH) $ 3,607.52
  • havvenSynthetix Network (SNX) $ 2.01
  • frax-etherFrax Ether (FRXETH) $ 3,356.50
  • nexoNEXO (NEXO) $ 1.16
  • fraxFrax (FRAX) $ 0.997730
  • conflux-tokenConflux (CFX) $ 0.155178
  • ecasheCash (XEC) $ 0.000032
  • dexeDeXe (DEXE) $ 10.95
  • decentralandDecentraland (MANA) $ 0.334002
  • book-of-memeBOOK OF MEME (BOME) $ 0.009001
  • wormholeWormhole (W) $ 0.344392
  • lido-staked-solLido Staked SOL (STSOL) $ 158.93
  • oasis-networkOasis Network (ROSE) $ 0.090570
  • mina-protocolMina Protocol (MINA) $ 0.540699
  • apecoinApeCoin (APE) $ 0.964586
  • zksyncZKsync (ZK) $ 0.162052
  • mantra-daoMANTRA (OM) $ 0.717353
  • safeSafe (SAFE) $ 1.39
  • iotaIOTA (IOTA) $ 0.177498
  • klay-tokenKlaytn (KLAY) $ 0.157765
  • swethSwell Ethereum (SWETH) $ 3,557.50
  • tether-goldTether Gold (XAUT) $ 2,334.47
  • pancakeswap-tokenPancakeSwap (CAKE) $ 2.13
  • dog-go-to-the-moon-runeDOG•GO•TO•THE•MOON (Runes) (DOG) $ 0.005619
  • livepeerLivepeer (LPT) $ 16.50
  • heliumHelium (HNT) $ 3.24
  • staked-frax-etherStaked Frax Ether (SFRXETH) $ 3,657.25
  • nervos-networkNervos Network (CKB) $ 0.011538
  • kavaKava (KAVA) $ 0.463195
  • mog-coinMog Coin (MOG) $ 0.000001
  • 1inch1inch (1INCH) $ 0.398428
  • true-usdTrueUSD (TUSD) $ 0.997856
  • theta-fuelTheta Fuel (TFUEL) $ 0.073380
  • xdce-crowd-saleXDC Network (XDC) $ 0.031899
  • aioz-networkAIOZ Network (AIOZ) $ 0.428054
  • rocket-poolRocket Pool (RPL) $ 22.88
  • arkhamArkham (ARKM) $ 1.98
  • constitutiondaoConstitutionDAO (PEOPLE) $ 0.088857
  • terra-lunaTerra Luna Classic (LUNC) $ 0.000082
  • bitcoin-goldBitcoin Gold (BTG) $ 25.52
  • ocean-protocolOcean Protocol (OCEAN) $ 0.685274
  • apenftAPENFT (NFT) $ 0.00000045
  • stader-ethxStader ETHx (ETHX) $ 3,454.92
  • illuviumIlluvium (ILV) $ 64.93
  • pax-goldPAX Gold (PAXG) $ 2,310.46
  • blurBlur (BLUR) $ 0.251289
  • aevo-exchangeAevo (AEVO) $ 0.503001
  • wemix-tokenWEMIX (WEMIX) $ 1.11
  • trust-wallet-tokenTrust Wallet (TWT) $ 1.01
  • usdbUSDB (USDB) $ 0.999784
  • woo-networkWOO (WOO) $ 0.212564
  • memecoin-2Memecoin (MEME) $ 0.019590
  • paypal-usdPayPal USD (PYUSD) $ 0.999289
  • turboTurbo (TURBO) $ 0.005787
  • corgiaiCorgiAI (CORGIAI) $ 0.001162
  • curve-dao-tokenCurve DAO (CRV) $ 0.315452
  • axelarAxelar (AXL) $ 0.559789
  • raydiumRaydium (RAY) $ 1.49
  • echelon-primeEchelon Prime (PRIME) $ 9.49
  • astarAstar (ASTR) $ 0.067872
  • iotexIoTeX (IOTX) $ 0.040349
  • magaMAGA (TRUMP) $ 8.12
  • mx-tokenMX (MX) $ 3.82
  • dydxdYdX (ETHDYDX) $ 1.40
  • ether-fiEther.fi (ETHFI) $ 3.24
  • popcatPopcat (POPCAT) $ 0.380390
  • aerodrome-financeAerodrome Finance (AERO) $ 0.734873
  • golemGolem (GLM) $ 0.363326
  • osmosisOsmosis (OSMO) $ 0.544185
  • kusamaKusama (KSM) $ 23.87
  • compound-ethercETH (CETH) $ 67.52
  • pepecoin-2PepeCoin (PEPECOIN) $ 3.05
  • stepnGMT (GMT) $ 0.164957
  • sats-ordinalsSATS (Ordinals) (SATS) $ 0.00000016
  • safepalSafePal (SFP) $ 0.744675
  • cat-in-a-dogs-worldcat in a dogs world (MEW) $ 0.003835
  • aragonAragon (ANT) $ 8.51
  • compound-governance-tokenCompound (COMP) $ 48.91
  • manta-networkManta Network (MANTA) $ 1.02
  • zilliqaZilliqa (ZIL) $ 0.017487
  • holotokenHolo (HOT) $ 0.001819
  • polymeshPolymesh (POLYX) $ 0.300858
  • celoCelo (CELO) $ 0.591626
  • compound-wrapped-btccWBTC (CWBTC) $ 1,221.93
  • ankrAnkr Network (ANKR) $ 0.031372
  • 0x0x Protocol (ZRX) $ 0.368016
  • ioio.net (IO) $ 3.29
  • biconomyBiconomy (BICO) $ 0.385178
  • superfarmSuperVerse (SUPER) $ 0.666934

ERC-2771 integration introduces address spoofing vulnerability — OpenZeppelin

0 95

ERC-2771 integration introduces address spoofing vulnerability — OpenZeppelin

  cointelegraph.com 08 December 2023 08:27, UTC

ERC-2771 integration introduces address spoofing vulnerability — OpenZeppelin

Soon after Thirdweb revealed a security vulnerability that could impact a variety of common smart contracts used across the Web3 ecosystem, OpenZeppelin identified two specific standards as the root cause of the threat.

On Dec. 4, Thirdweb reported a vulnerability in a commonly used open-source library, which could impact pre-built contracts, including DropERC20, ERC-721, ERC-1155 (all versions) and AirdropERC20.

In response, smart contracts development platform OpenZepplin and nonfungible token marketplaces Coinbase NFT and OpenSea proactively informed users about the threat. Upon further investigation, OpenZepplin found that the vulnerability stems from “a problematic integration of two specific standards: ERC-2771 and Multicall.”

The smart contract vulnerability in question arises after the integration of ERC-2771 and multicall standards. OpenZepplin identified 13 sets of vulnerable smart contracts, as shown below. However, crypto service providers are advised to address the issue before bad actors find a way to exploit the vulnerability.

ERC-2771 integration introduces address spoofing vulnerability — OpenZeppelin

Smart contract vulnerabilities linked to ERC-2771 integration. Source: Thirdweb

OpenZepplin’s investigation found that the ERC-2771 standard allows overriding certain call functions. This could be exploited to extract the sender’s address information and spoof calls on their behalf.

ERC-2771 integration introduces address spoofing vulnerability — OpenZeppelin

An attacker can potentially wrap multiple spoofed calls within a single multicall(bytes[]). Source: OpenZeppelin

OpenZepplin advised the Web3 community using the aforementioned integrations to use a 4-step method for ensuring safety: disable every trusted forwarder, pause contract and revoke approvals, prepare an upgrade and evaluate snapshot options.

In addition, Thirdweb launched a mitigation tool that allows users to connect their wallets and identify if a contract is vulnerable.

The decentralized finance platform Velodrome also deactivated its relay services until a new version was installed.

In a recent Cointelegraph Magazine article, experts revealed how artificial intelligence (AI) can help audit smart contracts and aid cybersecurity efforts.

James Edwards, the lead maintainer for cybersecurity investigator Librehash, said that while AI chatbots can develop smart contracts, deploying them in a live environment is risky.

On the other hand, Edwards highlighted the technology’s potential to vet smart contracts. Recent tests showed AI’s ability to “audit contracts with an unprecedented amount of accuracy that far surpasses what one could expect and would receive from GPT-4.”

While he concedes it’s not as good as a human auditor yet, it can already do a strong first pass to speed up the auditor’s work and make it more comprehensive.

Source

Leave A Reply

Your email address will not be published.