<p>On March 30, 2025, the DeFi protocol <strong>SIR.trading</strong> was hacked, resulting in the loss of $355,000 at the time of the writing. The attack was caused by a mistake when performing gas optimization using new <strong><a href="https://eips.ethereum.org/EIPS/eip-1153" rel="nofollow">EIP-1153</a></strong><a href="https://eips.ethereum.org/EIPS/eip-1153" rel="nofollow"> - </a><strong><a href="https://eips.ethereum.org/EIPS/eip-1153" rel="nofollow">Transient storage opcodes</a>.</strong></p><h3><strong>Overview</strong></h3><p>Attacker: <a href="https://etherscan.io/address/0x27defcfa6498f957918f407ed8a58eba2884768c" rel="nofollow">https://etherscan.io/address/0x27defcfa6498f957918f407ed8a58eba2884768c</a></p><p>Vulnerable Contract: <a href="https://etherscan.io/address/0xb91ae2c8365fd45030aba84a4666c4db074e53e7#code" rel="nofollow">https://etherscan.io/address/0xb91ae2c8365fd45030aba84a4666c4db074e53e7#code</a></p><p>Transaction attack: <a href="https://etherscan.io/tx/0xa05f047ddfdad9126624c4496b5d4a59f961ee7c091e7b4e38cee86f1335736f" rel="nofollow">https://etherscan.io/tx/0xa05f047ddfdad9126624c4496b5d4a59f961ee7c091e7b4e38cee86f1335736f</a></p><p><strong>EIP-1153 </strong><a href="https://eips.ethereum.org/EIPS/eip-1153" rel="nofollow">- </a><strong>Transient storage opcodes</strong> adds 2 opcodes for manipulating state that behaves almost identically to storage but is discarded after every transaction: </p><ul><li><p><code>TLOAD</code> pops one 32-byte word from the top of the stack, treats this value as the address, fetches 32-byte word from the transient storage at that address, and pushes the value on top of the stack.</p></li><li><p><code>TSTORE</code> pops two 32-byte words from the top of the stack. The word on the top is the address, and the next is the value. <code>TSTORE</code> saves the value at the given address in the transient storage.</p></li></ul><p>Addressing is the same as <code>SLOAD</code> and <code>SSTORE</code>. i.e. each 32-byte address points to a unique 32-byte word.</p><p>Gas cost for <code>TSTORE</code> is the same as a warm <code>SSTORE</code> of a dirty slot (i.e. original value is not new value and is not current value, currently 100 gas), and gas cost of <code>TLOAD</code> is the same as a hot <code>SLOAD</code> (value has been read before, currently 100 gas). Gas cost cannot be on par with memory access due to transient storage’s interactions with reverts.</p><p>All values in transient storage are discarded at the end of the transaction so basically we can use them like a cheaper storage that only last for a transaction. One use-case is the Reentrancy Locks. </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fa9a6f8e3-4cf0-4280-a40f-629338bc8a56_964x482.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/93746412e766de54ffea2995b96b8654.jpg" alt=""></source></picture><div><div><div></div><div></div></div></div></div></a></figure></div><h3><strong>Exploit Analysis</strong></h3><ul><li><p>In the <strong>mint</strong> function, the <strong>Vault</strong> contract of <strong>SIR.trading</strong> uses transient storage to to store <strong>UniswapV3pool</strong> address before performing <strong>swap.</strong></p></li></ul><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F39229473-4f27-4fb5-9bf7-3de74f7a2e41_900x366.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/fdebf86cab3ff67724499545f3bdb8c7.jpg" alt=""></source></picture><div><div><div></div><div></div></div></div></div></a></figure></div><ul><li><p>The pool address stored in transient storage <strong>0x1</strong> is later uses in <strong>uniswapV3SwapCallback</strong> to verify that the <strong>msg.sender</strong> is <strong>Uniswapv3 pool</strong> and then transfer tokens to the pool to performing swap. </p></li></ul><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fd5a089fa-343f-4995-83c1-ca5fc66d6de8_936x849.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/29b643f1284b4cc4bd4b4689d40a58e2.jpg" alt=""></source></picture><div><div><div></div><div></div></div></div></div></a></figure></div><ul><li><p>The implementation is correct up to this point, but then they need to return the <strong>amount</strong> to the <strong>mint</strong> function. They try to save gas costs again by using transient storage: storing the <strong>amount</strong> in transient storage <strong>0x1</strong> and loading it in the <strong>mint</strong> function.</p></li></ul><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F1cd2363f-b5fe-4f73-a423-289b678175d5_730x72.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/b35dbcc2f390b6acc1e335baa5aecec8.jpg" alt=""></source></picture><div></div></div></a></figure></div><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F97ac82f3-9cdb-4e99-bfb7-d218f0e49dd0_896x75.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/5b584cb6303f09db5fd86acc9d22d58f.jpg" alt=""></source></picture><div></div></div></a></figure></div><ul><li><p>This is where the pitfall occurs. The transient storage <strong>0x1 </strong>is now overwritten with <strong>amount </strong>and the transient storage remains for the whole transaction so if in this transaction, we call <strong>uniswapV3SwapCallback</strong> function again, it will load the <strong>0x1 </strong>which is now the <strong>amount</strong> instead of the pool address. Since the <strong>amount </strong>can be controlled by crafting  arguments in <strong>uniswapV3SwapCallback</strong> function, attacker bruteforced an address<strong> 0x00000000001271551295307acc16ba1e7e0d4281 </strong>(<strong>amount </strong>= <strong>95759995883742311247042417521410689</strong>).</p></li><li><p>The attacker deployed contract <strong>0x00000000001271551295307acc16ba1e7e0d4281</strong> with <strong>CREATE2, </strong>provided crafted arguments to <strong>mint</strong> exactly the number of tokens above, successfully manipulating the transient storage <strong>0x1</strong> to the <strong>amount (0x00000000001271551295307acc16ba1e7e0d4281)</strong>. The contract then<strong> </strong>directly called <strong>uniswapV3SwapCallback</strong>, bypass the <strong>Uniswapv3 pool</strong> check and transferred tokens from the vault to the attacker’s wallet.</p></li></ul><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fe888d1df-05fe-4596-ba91-65ee185bf893_1080x630.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/fc560f2575e83caf61e46537e7cec4ad.jpg" alt=""></source></picture><div><div><div></div><div></div></div></div></div></a></figure></div><h3><strong>Conclusion</strong></h3><p><strong><a href="https://eips.ethereum.org/EIPS/eip-1153" rel="nofollow">EIP-1153</a></strong><a href="https://eips.ethereum.org/EIPS/eip-1153" rel="nofollow"> - </a><strong><a href="https://eips.ethereum.org/EIPS/eip-1153" rel="nofollow">Transient storage opcodes</a> </strong>introduces a great way to save gas cost but with the great power comes with great responsibility. Smart contract developers should understand the lifetime of transient storage variables before use.</p><p>Because transient storage is automatically cleared at the end of the transaction, <strong>smart contract developers may be tempted to avoid clearing slots as part of a call in order to save gas</strong>. However, this could prevent further interactions with the contract in the same transaction (e.g. in the case of re-entrancy locks) or cause other bugs, so smart contract developers should be careful to <em><strong>only</strong></em><strong> leave transient storage slots with nonzero values when those slots are intended to be used by future calls within the same transaction</strong>. Otherwise, these opcodes <strong>behave exactly the same as </strong><code>SSTORE</code><strong> and </strong><code>SLOAD</code>, so all the usual security considerations apply especially in regard to <strong>reentrancy</strong> <strong>risk</strong>.</p><p>In the SIR.trading case, they did not clear the <strong>0x1</strong> slot after using it to store the <strong>uniswapPool</strong> and <strong>amount</strong>, and they also reused the <strong>0x1</strong> for the <strong>amount</strong>, which led to the exploitation.</p><p>Smart contract developers need to carefully understand the new features, especially the breaking changes, before using them. Always remember to review the <strong>EIPs</strong> carefully, including all security considerations, when implementing them.</p><p>Additionally, it is strongly recommended to <strong>conduct a security audit</strong>, not only for the first release version but also for any new features added in the future. Since the upgrading process can introduce various issues, it should also be thoroughly audited.</p>

EIP-1153 - Transient Storage: Save Gas, Lose Bag

<p>2025년 3월 30일, DeFi 프로토콜 <strong>SIR.trading</strong>이 해킹되어 작성 당시 355,000달러의 손실이 발생했습니다. 이 공격은 새로운 <strong><a href="https://eips.ethereum.org/EIPS/eip-1153" rel="nofollow">이더리움 개선 제안(EIP)-1153</a></strong><a href="https://eips.ethereum.org/EIPS/eip-1153" rel="nofollow"> - </a><strong><a href="https://eips.ethereum.org/EIPS/eip-1153" rel="nofollow">일시 저장소 명령어</a></strong>를 사용하여 가스 최적화를 수행하는 과정에서 발생한 실수로 인해 일어났습니다.</p><h3><strong>개요</strong></h3><p>공격자: <a href="https://etherscan.io/address/0x27defcfa6498f957918f407ed8a58eba2884768c" rel="nofollow">https://etherscan.io/address/0x27defcfa6498f957918f407ed8a58eba2884768c</a></p><p>취약한 계약: <a href="https://etherscan.io/address/0xb91ae2c8365fd45030aba84a4666c4db074e53e7#code" rel="nofollow">https://etherscan.io/address/0xb91ae2c8365fd45030aba84a4666c4db074e53e7#code</a></p><p>공격 트랜잭션: <a href="https://etherscan.io/tx/0xa05f047ddfdad9126624c4496b5d4a59f961ee7c091e7b4e38cee86f1335736f" rel="nofollow">https://etherscan.io/tx/0xa05f047ddfdad9126624c4496b5d4a59f961ee7c091e7b4e38cee86f1335736f</a></p>

(이하 생략, 동일한 방식으로 번역)

이더리움 개선 제안(EIP)-1153 - 일시적 저장: 가스 절약, 가방 손실

암호화폐 분석 회사 알프랙탈(Alphractal)은 최신 보고서에서 알트코인 시장에 대한 주목할 만한 관찰 결과를 발표했습니다.
보고서에 따르면, ENA와 TRUMP는 높은 시가총액을 기록한 알트코인 중 두드러지는 모습을 보였습니다.

분석 회사 경고: "지금 당장은 이 7개 알트코인에 접근하지 마세요"

이더리움 현물 ETF는 9월 5일 상당한 투자자 자금 유출을 보였습니다. 4억 4,700만 달러의 순유출을 기록했습니다. SoSoValue 데이터에 따르면, 이는 해당 카테고리에서 두 번째로 큰 자금 유출이었습니다.

이더리움 ETF 4억 4,700만 달러 자금 유출, 비트코인 ETF 1억 6,000만 달러 감소

투자자들은 다가오는 FOMC 회의에서 연준이 50bp(베이시스포인트) 금리 인하를 단행할 가능성을 가격에 반영하기 시작했습니다. 이는 다음 주 소비자물가지수 (소비자 가격 지수(CPI) 와 생산자물가지수(PPI) 발표를 앞두고 나온 것으로, 이 또한...