It was discovered that more than a dozen smart contracts standard ERC-20 on the basis of Ethereum contain bugs that allow criminals to generate as many tokens as they want.
Although the errors first detected 22 April and 24 April, was published PeckShield company specializing in the security of the blockchain, not directly related to the standard ERC-20, the problems led to the suspension of trade tokens ERC-20 OKEx exchanges, Poloniex, Changelly, Quoine and HitBTC. Huobi.Pro also announced
April 25 to suspend the trading of all coins, but later the restriction was modified and applied only to the tokens ERC-20. At the moment Poloniex gradually began to resume operations.
In one example an attacker who successfully exploited a bug, moved a whopping 57.9 * 10 ^ 57 tokens BeautyChain — show transaction data for Etherscan
— On April 22. This transaction was the start of the search error.
«Our study shows that such a transaction has occurred from attack «in vivo», which uses a previously unknown vulnerability in the contract. For development purposes we call this particular vulnerability batchOverflow,» said the company PeckShield. «I want to note that batchOverflow is essentially the classic problem of overflow in integer arithmetic.»
Record batchOverflow tells that the batchTransfer function of the contract is the maximum number of tokens that can be sent in the transaction, and noted that the value of the passed token must be less than the total number of tokens that were generated. However, the parameter «_value» — one of the two determining the total number of tokens — can be manipulated, allowing you to change another variable, resulting in criminals can create as many tokens as you want.
In addition, an attacker can bypass the barrier terms in the contract that usually guarantees the transfer of a reasonable number of tokens.
«With a zero quantity, the attacker can pass the health check in lines 258-259 and do the subtraction in line 261 is irrelevant» — said in the recording. «And here is the interesting part: as shown in the lines 262-265, the balance of the two recipients will be added by using extremely large values of _value, and the attacker it will not be worth a single coin!»
Although first reports indicated that all tokens ERC-20 may be affected, the «batchTransfer» is not part of the standard token. In an article on Medium not transferred to the list of affected projects, although it is noted that BeautyChain was the first project found for this issue. To emphasize the seriousness of the problem OKEx said
April 24 that it was suspending trade tokens BeautyChain.
At the same time, the exchange announced that in light of the errors was suspended deposits and withdrawals for the project SmartMesh due to «abnormal trading operations». In PeckShield note that it is, perhaps, due to the error proxyOverflow, which, like batchOverflow, is a classic problem with the overflow in the integer arithmetic. Some of the variables can be manipulated to generate a large number of tokens. One of the Twitter users noticed that the attacker has created a $5 octodecillion in tokens SmartMesh.
As noted in the article error, there is a risk that someone may use the affected cryptocurrency to control prices in their favor by trading with bitcoin, ether or another trading pair. In a statement on the website BeautyChain an error is confirmed and it is noted that trade will resume in the future. Similarly, SmartMesh announced that it will take steps to prevent price manipulation.
Fabian Vogelstein (Fabian Vogelsteller), the developer who first proposed a standard ERC-20, I noticed that error «just shows that we need better techniques and tools for their detection.»