SlowMist: The attacker re-enters the Lendf.Me contract through the "supply()" function to achieve a re-entry attack
2020-04-19 08:29
星球日报讯 慢雾安全团队发文跟进“DeFi平台Lendf.Me被黑”一事的具体原因及防御建议。文章分析称,通过将交易放在bloxy.info上查看完整交易流程,可发现攻击者对Lendf.Me进行了两次“supply()”函数的调用,但是这两次调用都是独立的,并不是在前一笔“supply()”函数中再次调用“supply()”函数。紧接着,在第二次“supply()”函数的调用过程中,攻击者在他自己的合约中对Lendf.Me的“withdraw()”函数发起调用,最终提现。
慢雾安全团队表示,不难分析出,攻击者的“withdraw()”调用是发生在transferFrom函数中,也就是在Lendf.Me通过transferFrom调用用户的“tokensToSend()”钩子函数的时候调用的。很明显,攻击者通过“supply()”函数重入了Lendf.Me合约,造成了重入攻击。
最热快讯
资讯热榜
日榜
周榜
Hyperliquid’s 50x leveraged BTC short position turned from loss to profit, with a floating profit of over $600,000
James Wynn wrote a long article about himself: He started playing with contracts in March, earned 8-digit profits from Meme coins, and lost 100 million in a week
BTC rebounded and broke through 102,000 USDT, and the 24-hour decline narrowed to 2.87%
SlowMist: Lazarus hackers are using a new stealing Trojan, OtterCookie, to target cryptographic practitioners
Abraxas Capital shorts mainstream currencies for hedging, with current floating profits exceeding $55 million
TRUMP wallet official website linked to account X for the second time