Thread by @Dexaran

$EOS #EOSPlay is being hacked

Investigating the issue. All my contracts on EOS mainnet has stopped because of network congestion.

https://twitter.com/rektkid_/status/1172597208899903488?s=21

bloks.io/account/mumach…

So, $EOS is still in congestion mode. My 20 staked EOS CPU gave me 6 ms instead of 2800ms as it should be in a normal stage.

It seems that the scale of the attack is much larger than we originally expected.
These are attacker's accounts:
eosflare.io/account/mumach…
eosflare.io/account/gotowo…
eosflare.io/account/mumach…
eosflare.io/account/mumach…
eosflare.io/account/mumach…
eosflare.io/account/mumach…
eosflare.io/account/mumach…

Contracts being attacked:

eosflare.io/account/dswinn…
eosflare.io/account/eospla…

probably even more...

What attacker did:

1. Rented a huge amount of CPU and NET at #EOSREX resource exchange.

2. Staked CPU&NET for (1) himself and (2) attacked contract.

3. Congested the network.

4. Initiated some transactions to the attacked contract. Won a lot of $EOS in gambling DApps.

1/ Explanation (possible scenario): RNG hack

1. By congesting the network the attacker disallowed anyone to send transactions because transaction cost is too high for most of the users.

2/ Explanation:

Probably the RNG of attacked gambling DApps could use some transactions or data from earlier blocks as a source of entropy.
It's easier to manipulate "previous blocks" when the network is congested and you are the only one having resources to send transactions.

3 / Explanation:

I.e. if you are the only one who sends transactions and RNG relies on transactions(or blocks) as a source of entropy, you can manipulate RNG and set winning conditions, and then receive all winnings. Devs could not redeploy the contract due to lack of resources.

$EOS #hack

@BigONEexchange
@eoslaomao
@EOS_huobipool
@eoseoul_kor
@infstones
@EOS_Nation
@NewdexOfficial
@WhaleExchange
@eosasia_one
@ZB__EOS
@eoscochain
@StarteosIO
@Lambdaim
@atticlab_it
@eosbeijing
@SlowMist_Team
@eosnewyork
@cannon_eos
@eoscafeblock

dappradar.com/eos/1124/spina…

$EOS #EOSPlay and #Spinach DApps are hacked. At least 35K EOS were stolen right now. This addresses are probably worth tracking and blacklisting until BPs will make a decision.

@binance @bitfinex @Poloniex @HuobiGlobal @OKEx @OKCoin @kucoincom @C2CXExchange @BittrexExchange

@BigONEexchange @EOSLaoMao @EOS_huobipool @eoseoul_kor @infstones @EOS_Nation @NewdexOfficial @WhaleExchange @EOSAsia_one @ZB__EOS @eoscochain @StarteosIO @Lambdaim @atticlab_it @eosbeijing @SlowMist_Team @eosnewyork @cannon_eos @eoscafeblock 4/ Explanation:

Network congestion makes (1) hacker and (2) attacked DApp the only users of the network who had enough CPU to operate. This prevents contract developers from redeploying the contract and stopping the attack when they recognized the issue.

@BigONEexchange @EOSLaoMao @EOS_huobipool @eoseoul_kor @infstones @EOS_Nation @NewdexOfficial @WhaleExchange @EOSAsia_one @ZB__EOS @eoscochain @StarteosIO @Lambdaim @atticlab_it @eosbeijing @SlowMist_Team @eosnewyork @cannon_eos @eoscafeblock 5/ Update:

The attacker did not use the previous blocks as I thought initially. He fills future blocks with the transaction he needs instead.

@BigONEexchange @EOSLaoMao @EOS_huobipool @eoseoul_kor @infstones @EOS_Nation @NewdexOfficial @WhaleExchange @EOSAsia_one @ZB__EOS @eoscochain @StarteosIO @Lambdaim @atticlab_it @eosbeijing @SlowMist_Team @eosnewyork @cannon_eos @eoscafeblock Source: @Mikefletcher42

https://twitter.com/Mikefletcher42/status/1172789474000023552

@BigONEexchange @EOSLaoMao @EOS_huobipool @eoseoul_kor @infstones @EOS_Nation @NewdexOfficial @WhaleExchange @EOSAsia_one @ZB__EOS @eoscochain @StarteosIO @Lambdaim @atticlab_it @eosbeijing @SlowMist_Team @eosnewyork @cannon_eos @eoscafeblock @Mikefletcher42 Attack stopped, network is back in a normal mode. >30K EOS stolen because of the vulnerability of DApp design. Not $EOS flaw. Just a smart-contract that was hacked.

To smart-contract devs:
1. Follow best security practices.
2. Do not rely on on-chain source of entropy in EOS.

@BigONEexchange @EOSLaoMao @EOS_huobipool @eoseoul_kor @infstones @EOS_Nation @NewdexOfficial @WhaleExchange @EOSAsia_one @ZB__EOS @eoscochain @StarteosIO @Lambdaim @atticlab_it @eosbeijing @SlowMist_Team @eosnewyork @cannon_eos @eoscafeblock @Mikefletcher42 This is also worth watching