Superfluid_ HQ hacked analysis

front ⾔

2022 year 2 month 8 Japan , Know Chuangyu blockchain Security Lab Detected on Ethereum DeFi agreement superfluid Encounter hacker attack , Loss exceeding 1300 Thousands of dollars . The laboratory tracked and analyzed this event for the first time .

The attack involves basic information

Superfluid：0xEBbe9a6688be25d058C9469Ee4807E5eF192897f

Attack trading hash：0x396b6ee91216cf6e7c89f0c6044dfc97e84647f5007a658ca899040471ab4d67

Hacker address ：0x1574F7F4C9d3aCa2EbcE918e5d19d18aE853c090

Attack contract address : 0x32D47ba0aFfC9569298d4598f7Bf8348Ce8DA6D4

Vulnerability analysis

The core of the vulnerability

The core of this vulnerability lies in the function callAgreement, This function is mainly used to provide a function named "ctx" Data structure of ,“ctx” Used for communication sharing between protocols . The attacker of this incident is right ”ctx“ The data are forge , Achieve the purpose of cheating the contract .

Exploit

Why fake data is used and how attackers construct fake “ctx” Data ？

From the transaction, we can see that the attacker is directly in callData A false is passed in at the end “ctx”, At the same time, it's really “ctx” The data is also constructed , It's just that the program will callData Data and “ctx” Packaged into an object , When the protocol decodes the object ,ABI The decoder will only process the data at the front and ignore the data at the back .

And build a fake “ctx” The data is not complicated , because “ctx” The end of the structure is all zero, so we only need to imitate “ctx” Structure adds it directly to userData in , The following is an official example of how to build a fake “ctx”：

summary

This attack event lies in the unconditional trust of the source data during protocol data processing , User data should be identified and distinguished from official construction data . In the near future , Various contract vulnerabilities and security incidents occur frequently , Contract audit 、 Risk control measures 、 It is necessary to implement the emergency plan .