April 17, 2024

Targeted ETHW Contract Disclaims Replay Attack

Invaders launched a hit on the post-merge chain (ETHW) on Ethereum’s Proof-of-Work blockchain. The attack occurred over the weekend after the chain got exploited by a hybrid-chain contract. However, it forwarded a denial of the mode of the attack. 

ETHW Annuls Replay Attack Claims 

BlockSec, a smart contract auditing agency, motioned what seemed like an ETH replay attack on September 16. During the attack, the Invaders scooped ETHW tokens. They did so by modifying the call data of the ETH PoS block and replaying it on the ETH PoW layer. 

The analyst attributed the reason behind the deed to an Omni fused chain bridge on ETHW. According to BlockSec, the bridge incorporated a previous chain identity that did not correlate with the new chain. Therefore, it could not verify messages sent to the correct chain. 

ETH mainnet adopted two verifiers for its test networks that perform distinct functions. One is a network identifier, while the other is a chain identifier. Both IDs look after the chain and run its affairs. 

Network identifier focuses on p2p messages betwixt nodes on the block. Meanwhile, the chain identifier verifies transaction signatures on the block. 

EIP-155 initiated a chain identifier to restrict replay attacks on ETH (Ethereum), and ETC (Ethereum Classic) chains. 

Immediately BlockSec discovered there was an attack; it informed Ethereum PoW handlers. The contract instead dismissed the claim that it had suffered an on-chain invasion. It said it was a call data replay on the contract and not transactional on-chain action.

However, it tried to inform Omni Bridge of the attack as an exploit of its contract. 

Report Of The Attack

According to the report, the attacker began by moving two hundred ETH PoW tokens to an unknown wallet. They took advantage of the Omni Bridge belonging to the Gnosis chain. Afterward, they replayed a similar message on the ETH PoS chain and scooped an extra two hundred ETHW tokens. 

Eventually, they milked the balance of the PoW chain to the last drop. An examination of the Omni Bridge revealed that the method to confirm chain identity was available. However, unit storage provided the used chainID from its value storage and was old.

Later, the developers confirmed the identifier to be different from the chainID suggested opcode. EIP-1344 designed and introduced a new ID due to the fork that followed the merge. 

Using the old ID allowed the attacker to not only scoop the ETH PoW token. They gained access to other assets on the network. Afterward they went to sell these tokens on legit platforms.

Cointelegraph met with BlockSec to determine the number of assets stolen during the heist. 

Ethereum PoW chain only exists because some miners concluded on mining new tokens. ETH has successfully transitioned to Proof-of-Stake from Proof-of-Work. So, this recent attack on PoW has less to do with its PoS counterpart. 

It is worth noting that the merge reduced Ethereum’s total supply. 

According to CoinMarketCap, ETHW was trading at $8.16 at press time.

Leave a Reply

Your email address will not be published. Required fields are marked *