It is safe flaw, concern with bourse again.
Today, exposure of PeckShield of group of safety of area piece catenary the flaw of agreement of aether lane intelligence that the name is TradeTrap, this flaw can make a hacker optional hold price controlling money, optional add hair Token, this flaw already affected more than 10 kinds of Token that can trade in bourse. Release up to the article, involved exchange is successful already repair this flaw.
This intelligent agreement flaw that is called TradeTrap affects 700 many ERC-20 Token, also include AI, SUB, NTO, TGT, FC, TBT to wait for Token inside among them tens of the Token that has traded in bourse, install to involve money, 26 bourse such as igneous money, OKEx, HitBTC, ZB, EtherDelta, IDEX.
This flaw is the influence user amount that discovers this year the biggest, involve money to plant most, involve the safe leak with most bourse, it is reported this leak is possible intended or be by development staff obligate innocently in intelligent agreement, if purpose is good,won't cause an effect, but if be abused by the hacker, easily implementation is covered illegally benefit and hold the safe incident that charges the price to happen.
History go up the exposure of detail of intelligent agreement flaw with the largest incidence
BlockBeats of area piece rhythm understands from PeckShield group office, tradeTrap flaw includes many foregone safe issues:
(1) the hacker can raise Token remaining sum at will through MintToken() function (2) the hacker can use SetPrices() Buy() Sell() 3 function will operate Token price, and have the unfair action that cover interest (3) BuyTrap and SellTrap, token cannot be received to perhaps sell after can letting purchaser and success of the person that sell pay after going out unavailable income.
In the intelligent agreement of existence TradeTrap flaw, peckShield discovers a function that the name is MintToken() , this function can be used at adding hair Token remaining sum along with address of lane of intent either aether by the hacker.
Will tell commonly, this function can be controlled to use by agreement owner only, be used at agreement Token add hair. This function basically is used at Token to open to booking level, the project just can use this function to issue corresponding Token to illicit collect investor, in disuse of the behoove after opening to booking an end this function. But actually, this function can be used at will as before after opening to booking an end.
If project exposure increases hair plan and just did not abuse this function, can add hair project Token to address of either aether lane. Without foundation increases the Token amount of hair, will disturb the market of this Token trades, take a loss to investor.
It is in order to be put in the Substratum of this flaw exemple, the Token gross of this project exists on each platform huge gap, ill will adds the suspicion of hair.
The inquiry in EtherScan has 592 million Token in address of SUB Token agreement, the data platform such as blame trumpet, Coinmarketcap shows SUB Token issues gross to be 472 million. Circulation of the Token in the white book that BlockBeats of area piece rhythm also discovers Substratum also has had change for many times, in the white paper August 2017, its issue an amount to be 600 million Token, in December in white paper, hair linage quantity is 226 million.
Discover after be communicated with PeckShield group Substratum has transferred MintToken() function really, do those who cross 580 million Token to add hair, the flaw that shows this interface is really effective and usable. At present this group already Medium makes a statement express to checking a network to had used this function only, had not undertaken adding sending after trade.
Price of consist in of another safety problem operates on. Appearing in the intelligent agreement of this kind of problem, have SetPrice() , Buy() , Sell() 3 function, this function can be undertaken controlling by intelligent agreement owner only, can set Token buy and sale price. The public can use function of Buy() , Sell() to have the action of buying and selling of Token directly.
Read agreement code carefully to be able to discover, the price in the Token in this agreement is will have pilot by the everybody of agreement, but market midstream connects Token buy and sale price should be decided actually by the market, this flaw lets a hacker have an opportunity that can be exploited to sbs advantage, can operate the price covers interest.
In the intelligent agreement that is affected by this flaw, the BuyPrice that can carry intelligent agreement and SellPrice and project just do business the user, for instance of EOS numerous prepare even if this kind can allow user and agreement to do business, meanwhile EOS can do business in bourse again. But the BuyPrice in intelligent agreement and SellPrice numerical value can not undertake be updatinged in time with the market, the difference of the contract price that produces in replacing a process and market value, formed the space that cover interest.
Below certain circumstance, the bourse of cherish against the law can use this flaw to come low buys Token, fill money to arrive after bourse next sell according to market high price again piece, form what him bourse undertakes to cover interest, this is the act that violates business ethics actually.
The Token that at present this flaw affected INT, SUB, SWFTC to wait, these Token are in the bourse such as money of OKEx, fire, HitBTC, IDEX, EtherDelta does business.
Bourse already repair TradeTrap flaw, user but safety trades
Because do it,the before 360 public relations behavior after EOS flaw exposure caused tremendous effect to the market, because information is communicated,bring about a large number of investor not free and cause capital loss, peckShield group decides not to discover in flaw for a short while flaw to public exposure, make communication affirm and report again after repair with bourse however flaw detail, assure what flaw reports flow to close compasses.
Father Jiang Xu Xian tells area piece rhythm BlockBeats, " we do not hope flaw for a short while exposure can bring negative effect to the market, after all TradeTrap flaw involves the many Token that trading in bourse, optional ground exposure may take panic to the market, cause needless loss to broad investor. "
At present money is installed, igneous money, OKEx, OKCoinKR, CoinEgg, Kucoin, Allcoin, HitBTC, Bitbns, ZB, OTCBTC, CoinBene, COSS, Etherdelta, ForkDelta, IDEX, YEX, Tidex, Radar Relay, Yobit, WazirX, CoinExchange, CoinSpot, Bluetrade, CEX, , money is installed wait for bourse to just already affirmed with SUB project flaw does not have major effect, the user can be at ease trade.
But we can't help wanting to ask below this problem:
Why be always when does safe group go into action ability rehabilitate flaw?
Since began to have safe group exposure April since flaw of safety of area piece catenary, it is safe group takes the lead in reporting flaw, next the bourse of experience thing, project just now of follow-up, always be slow one pace.
Countless times the ground is in BlockBeats of area piece rhythm safe flaw happens backward experience thing just is given out interrogatory, especially bourse, whether had we done work of examine and verify? So called go up whether is money examine and verify technological process of a form only?
And bourse of much recently home is to go up at will more money, do not go completely voting to go up the flow of money. The money on OKEx went up without money of any BEC that are substantial information, fire XMX of money of simple idea community, money is installed on the QuarkChain that the line is suspected of misdirect consumer, what investor sees is media attacks the conduct propaganda of baldachin ground and potential investment opportunity, but what BlockBeats of area piece rhythm sees is interest correlation, inside trades however, this kind " take a concern " behavior is without security not only but character, it is to be incident of safety of area piece catenary to bury more fell " foreshadowing " .
The Set/buy/sellPrice flaw that above face mentions is exemple, bourse is to completely the opportunity uses this agreement flaw to come low buys Token, sell when the market is rising subsequently piece, implementation covers interest, perhaps use low cost Token to operate currency value, score gain with this. But disclose to avoid this kind of issue, the address full money of bourse can change regularly, brought about Token to lose a track after flowing to bourse.
To investigation member for, bourse is current whole area piece the chain is the biggest black hole in ecosystem, all going to the center is changed, transparent method is changing exchange through the center after this skill, will become cannot track, make itself of area piece catenary lost a sense.
To safety the processing technique of the problem is to encounter before exchange order, handle, to the safe problem that future may appear, do not adopt any precautionary measures, also won't inform the user will stop in time when problem happening caustic, to appearing the Token of the problem, also do not have any remedy measure effectively. The EDU agreement flaw that happens recently for instance, the practice of igneous money net is merely money should go up to trade afresh after flaw of rehabilitate of project square requirement just, the investor of damage, the asset remaining sum that can look at oneself only drops.
The exchange that the center changes should bear the pecuniary loss that safe problem brings for investor, although fictitious money is the investment project of high risk, but assume on money examine and verify and trade safe is bourse, assure to trade safety and capital safety are the responsibility with the obligatory exchange that the center changes.
Although opposite of BlockBeats of area piece rhythm spends Chen Wei star of conduct propaganda not to catch a cold, but still hope his " transparent plan " effectively ground is advanced go down, be bourse of moment canal canal.
