The Vanishing Debt — An Analysis of the Notional Finance Hack

2. Immediately afterward, the attacker known as the safeTransferFrom operate of the ERC1155Trade contract to mint an fCash pair with an quantity of 1. The corresponding bond asset had a moneyGroupId of 2 and a maturity timestamp of 1788480000 (September 4, 2026, at 08:00). This known as the inside operate _upsertAsset, which up to date the legal responsibility and anticipated earnings of the from handle (the assault contract) and the to handle (receiving contract 1), respectively.

After the pair was minted, Portfolios instantly checked the free collateral of the assault contract. Since the quantity of the first mint was too small, its conversion into ETH beneath the present change price and precision was rounded all the way down to zero, permitting the first examine to go.

3. The attacker then known as the safeTransferFrom operate of the ERC1155Trade contract once more to mint an fCash pair with an quantity of uint128.max. This time, the corresponding bond asset additionally had a moneyGroupId of 2, however its maturity timestamp was 1796256000 (December 3, 2026, at 08:00).

There is a element right here: the attacker minted bond property with totally different maturity dates to 2 totally different addresses, respectively. This is as a result of when updating the legal responsibility of the from handle, if the bond property had been the identical, they might be straight added collectively, inflicting an overflow throughout the addition and leading to a revert (the contract makes use of the SafeMath library).

4. After the second mint up to date the legal responsibility and anticipated earnings of the from handle (the assault contract) and the to handle (receiving contract 2), the mintfCashPair operate known as the freeCollateral operate to calculate the web collateral place of the from handle and examine that it was better than or equal to 0 for the place to be thought of wholesome.

First, the getRequirement operate in the RiskFramework contract provides collectively the whole liabilities from the two mints of the from handle:

The remaining result’s -2¹²⁸. It then calls the convertBalancesToETH operate of the Escrow contract to transform this worth into an ETH-denominated worth, whereas the convertBalancesToETH operate in flip calls the _convertToETH operate of the ExchangeCharge library for the calculation.

Following the _convertToETH operate, it may be discovered that it first takes the absolute worth of steadiness after which calls uint128 to transform the 256-bit worth to 128 bits. Since the whole legal responsibility of the from handle above is -2¹²⁸, taking its absolute worth offers 2¹²⁸, and when uint128() is used for the pressured conversion, the worth exceeds the higher restrict and overflows to 0. This implies that the protocol incorrectly considers the free collateral place of the from handle to be 0 and wholesome, thereby passing the remaining examine in the mintfCashPair operate.

5. The receiving contract 2 then cut up its place amongst two different auxiliary contracts. These two safeTransferFrom calls nonetheless entered the mintfCashPair operate. However, as a result of the payer at this level was receiving contract 2 from the second mint, which held the enormous anticipated earnings place obtained in the earlier step, the threat calculation handled it as a optimistic declare and due to this fact handed the collateral examine. The two auxiliary contracts thus obtained receiver fCash that may very well be transformed into money upon maturity.

6. The attacker then initiated the second formal revenue transaction. In this transaction, the corresponding claims of the two auxiliary contracts holding the positions from the earlier transaction had been settled, rising the money steadiness of the corresponding property. The attacker then known as the withdraw operate of the Escrow contract to withdraw the property and understand the revenue.

Summary

The key level of this assault is that the attacker first used two separate positions to make the sum of the payer’s liabilities precisely 2¹²⁸, after which had the Escrow convert this legal responsibility into ETH. By exploiting the overflow vulnerability in the sort conversion to truncate the end result to zero, the threat examine was due to this fact allowed to go.

The SlowMist Security Team recommends that tasks should carry out vary checks earlier than sort conversions, and straight reject outcomes exceeding sort(uint128).max. At the identical time, all boundaries involving signed quantities, precision scaling, and asset denominations ought to be coated by extreme-value testing, particularly inputs corresponding to uint128.max, uint128.max + 1, and the absolute values of unfavourable numbers. The SafeCast library from OpenZeppelin may be referenced or used for conversion dealing with.

About SlowMist

SlowMist is a risk intelligence agency targeted on blockchain safety, established in January 2018. The agency was began by a group with over ten years of community safety expertise to turn out to be a world pressure. Our objective is to make the blockchain ecosystem as safe as attainable for everybody. We are actually a famend worldwide blockchain safety agency that has labored on numerous well-known tasks corresponding to HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, and so forth.

SlowMist affords a range of providers that embrace however will not be restricted to safety audits, risk info, protection deployment, safety consultants, and different security-related providers. We additionally supply AML (Anti-money laundering) software program, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and different SaaS merchandise. We have partnerships with home and worldwide companies corresponding to Akamai, BitDefender, RC², TianJi Partners, IPIP, and so forth. Our intensive work in cryptocurrency crime investigations has been cited by worldwide organizations and authorities our bodies, together with the United Nations Security Council and the United Nations Office on Drugs and Crime.

By delivering a complete safety answer personalized to particular person tasks, we will establish dangers and forestall them from occurring. Our group was capable of finding and publish a number of high-risk blockchain safety flaws. By doing so, we might unfold consciousness and lift the safety requirements in the blockchain ecosystem.