⚠️⚠️
$625 million worth of cryptocurrencies were stolen from the Ronin Bridge protocol in March 2022 as a result of an attack by hackers.
In June, Harmony One’s Horizon Bridge lost over $100 million in an attack.
🧵👇..
$625 million worth of cryptocurrencies were stolen from the Ronin Bridge protocol in March 2022 as a result of an attack by hackers.
In June, Harmony One’s Horizon Bridge lost over $100 million in an attack.
🧵👇..
In August, the Nomad Bridge lost another $200 million as a result of an exploited vulnerability in its smart contracts.
Hackers exploited the BSC Token Hub, a cross-chain bridge, on October 6 and drain $570 million.
⬇️⬇️
Hackers exploited the BSC Token Hub, a cross-chain bridge, on October 6 and drain $570 million.
⬇️⬇️
What are the common in all the above hacks?
They all are blockchain bridge hacks.
Let’s understand how these Bridges are Hacked.
#cybersecurity
⬇️⬇️
They all are blockchain bridge hacks.
Let’s understand how these Bridges are Hacked.
#cybersecurity
⬇️⬇️
Fake Events:
A cross-chain bridge often monitors deposit events on one blockchain to transfer funds to the other.
If an attacker can generate a deposit event without making a real deposit or by depositing with a valueless token, they can withdraw value from bridge at other end.
A cross-chain bridge often monitors deposit events on one blockchain to transfer funds to the other.
If an attacker can generate a deposit event without making a real deposit or by depositing with a valueless token, they can withdraw value from bridge at other end.
Message Verification Bug:
Cross-chain bridges confirm the legitimacy of a deposit or withdrawal prior to beginning any transactions.
A missed signature validation is often all it takes for hackers to gain access to millions of dollars.
⬇️⬇️
Cross-chain bridges confirm the legitimacy of a deposit or withdrawal prior to beginning any transactions.
A missed signature validation is often all it takes for hackers to gain access to millions of dollars.
⬇️⬇️
Lack of cross-contract access control in blockchain bridges:
It is important to have access control validations on critical functions that execute actions like modifying the owner, transferring funds and tokens, pausing and unpausing the contracts, etc.
⬇️⬇️
It is important to have access control validations on critical functions that execute actions like modifying the owner, transferring funds and tokens, pausing and unpausing the contracts, etc.
⬇️⬇️
Validator Takeover:
Some cross-chain bridges have a set of validators that vote whether or not to approve a particular transfer. If the attacker controls most of these validators, they can approve fake and malicious transfers.
⬇️⬇️
Some cross-chain bridges have a set of validators that vote whether or not to approve a particular transfer. If the attacker controls most of these validators, they can approve fake and malicious transfers.
⬇️⬇️
Admin Private Key Leak:
If the admin key of the smart contract is leaked, all the funds and operation of the smart contract will be at great risk. Recently, the Harmony bridge was exploited via the theft of two private keys.
⬇️⬇️
If the admin key of the smart contract is leaked, all the funds and operation of the smart contract will be at great risk. Recently, the Harmony bridge was exploited via the theft of two private keys.
⬇️⬇️
To understand the in-depth of Bridge Security in Blockchain.
Follow the article: quillaudits.medium.com/bridge-securit…
Follow the article: quillaudits.medium.com/bridge-securit…
Follow
@QuillAudits on Twitter and telegram to stay updated
Protect your Web3 Project with us - audits.quillhash.com/smart-contract…
#cybersecurity #blockchain #quillaudits #smartcontract #security #smartcontractaudit
@QuillAudits on Twitter and telegram to stay updated
Protect your Web3 Project with us - audits.quillhash.com/smart-contract…
#cybersecurity #blockchain #quillaudits #smartcontract #security #smartcontractaudit
• • •
Missing some Tweet in this thread? You can try to
force a refresh
