On April 19, 2024, HedgeyFinance suffered an exploit resulting in an estimated loss of $45 million. A design error in the Campaign contract permitted an attacker to directly steal a substantial amount of assets. In this blog, we will analyze the first attack on the Ethereum network to help users prevent similar vulnerabilities in their own projects.

<p>On April 19, 2024, HedgeyFinance suffered an exploit resulting in an estimated loss of $45 million. A design error in the Campaign contract permitted an attacker to directly steal a substantial amount of assets.</p><p>In this blog, we will analyze the first attack on the Ethereum network to help users prevent similar vulnerabilities in their own projects.</p><div><div><div><p>Thanks for reading Verichains! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div><h2>Overview</h2><p>Attacker:</p><p><a href="https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2" rel="nofollow">https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2</a></p><p>Vulnerable Contract:</p><p><a href="https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511" rel="nofollow">https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511</a></p><p>Transaction attack:</p><p><a href="https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517" rel="nofollow">https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517</a></p><p><a href="https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739" rel="nofollow">https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739</a></p><h2>Exploit Analysis</h2><p>Following the first transaction, the attack methodology was surprisingly straightforward. The attacker borrowed a large amount of USDC to create a locked campaign and then immediately canceled it.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fa957e94c-6cf2-4dee-8589-ef60fb833a70_2496x914.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/a61c9e226be8b37f1e8e5bf2dd064056.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>In the second transaction, the attacker triggered the contract to transfer USDC directly from the HedgeyFinance contract to their own address.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F90bd4a27-82f2-4c36-84f3-3299c517b658_2482x284.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/5b334a1f9367df61b976daf66c7cfd21.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>The simplicity of the second transaction strongly suggests that the root cause of the exploit lies in the <code>createLockedCampaign</code> and <code>cancel</code> functions from step 1.</p><p>Investigate the createLockedCampaign function</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F572423da-93c1-4561-ba4b-babe23cbbe11_1940x1220.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/80986f5e04f7ad9ca0f32be5a4cd8981.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>During the creation of a locked campaign, the owner has the ability to designate a tokenLocker. This tokenLocker, upon receiving approval, can then transfer out all the tokens associated with the newly created campaign. This behavior appears to be a potential vulnerability.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F37e738ba-6e28-46e4-8518-44e28ea9b539_1978x348.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/f4a244bc78e3d917fae0df39c57e80ce.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>While the function comment indicates an intent to prevent anyone from claiming additional tokens, it appears to only restrict access to reward tokens. Crucially, the function doesn't revoke approval granted in a previous step. This oversight allows the attacker to withdraw all staked tokens within the campaign while retaining the approval from the earlier step.</p><p>With this lingering approval, the attacker can easily transfer tokens out of the contract to any desired location.</p><p>By analyzing the <code>createLockedCampaign</code> function in reverse, it becomes clear that the approval logic is flawed. Granting the ability for a locked campaign to transfer tokens out at any time contradicts the expected behavior. This design flaw is the root cause of the HedgeyFinance exploit.</p><h2>Lesson learned</h2><p>The HedgeyFinance exploit highlights the severe consequences of failing to manage token approvals carefully within smart contracts. Here are key takeaways:</p><ul><li><p><strong>Approval is Power:</strong> In DeFi systems, granting approval to a contract often means giving it the power to transfer your tokens. Treat approvals with the same caution as sending funds directly.</p></li><li><p><strong>Revoke When Done:</strong> When an interaction with a smart contract is complete, diligently revoke any approvals that are no longer required. This limits the potential attack surface.</p></li></ul><div><div><div><p>Thanks for reading Verichains! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div>

Approval Error Vulnerability: Analyzing the HedgeyFinance Attack

2024 年 4 月 19 日，HedgeyFinance 遭受攻擊，估計損失 4500 萬美元。Campaign 合約中的設計錯誤允許攻擊者直接竊取大量資產。在本博客中，我們將分析對以太坊網絡的第一次攻擊，以幫助用戶防止自己的項目中出現類似的漏洞。

<p>2024 年 4 月 19 日，HedgeyFinance 遭受攻擊，造成估計損失 4,500 萬美元。 Campaign 合約中的設計錯誤允許攻擊者直接竊取大量資產。</p><p>在本部落格中，我們將分析以太坊網路上的第一次攻擊，以幫助使用者預防自己專案中的類似漏洞。</p><div><div><div><p>感謝您閱讀 Verichains！免費訂閱以接收新帖子並支持我的工作。</p></div><div><div></div><div></div></div></div></div><h2>概述</h2><p>攻擊者：</p><p> <a href="https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2" rel="nofollow">https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2</a></p><p>脆弱合約：</p><p> <a href="https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511" rel="nofollow">https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511</a></p><p>交易攻擊：</p><p> <a href="https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517" rel="nofollow">https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517</a></p><p> <a href="https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739" rel="nofollow">https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739</a></p><h2>漏洞利用分析</h2><p>在第一筆交易之後，攻擊方法出乎意料地簡單。攻擊者藉用大量USDC來建立鎖定活動，然後立即取消活動。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fa957e94c-6cf2-4dee-8589-ef60fb833a70_2496x914.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/a61c9e226be8b37f1e8e5bf2dd064056.jpg" alt=""></source></picture><div></div></div></figure></div><p>在第二筆交易中，攻擊者觸發合約將USDC直接從 HedgeyFinance 合約轉移到自己的地址。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F90bd4a27-82f2-4c36-84f3-3299c517b658_2482x284.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/5b334a1f9367df61b976daf66c7cfd21.jpg" alt=""></source></picture><div></div></div></figure></div><p>第二筆交易的簡單性強烈表明，該漏洞利用的根本原因在於步驟 1 中的<code>createLockedCampaign</code>和<code>cancel</code>函數。</p><p>研究 createLockedCampaign 函數</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F572423da-93c1-4561-ba4b-babe23cbbe11_1940x1220.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/80986f5e04f7ad9ca0f32be5a4cd8981.jpg" alt=""></source></picture><div></div></div></figure></div><p>在建立鎖定活動期間，擁有者可以指定 tokenLocker。該 tokenLocker 在獲得批准後，可以轉出與新創建的活動相關的所有代幣。此行為似乎是一個潛在的漏洞。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F37e738ba-6e28-46e4-8518-44e28ea9b539_1978x348.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/f4a244bc78e3d917fae0df39c57e80ce.jpg" alt=""></source></picture><div></div></div></figure></div><p>雖然函數註釋表明意圖阻止任何人要求額外代幣，但它似乎僅限制對獎勵代幣的存取。至關重要的是，該功能不會撤銷上一步中授予的批准。這種疏忽允許攻擊者撤回活動中所有質押的代幣，同時保留先前步驟的批准。</p><p>透過這種持續的批准，攻擊者可以輕鬆地將代幣從合約轉移到任何所需的位置。</p><p>透過逆向分析<code>createLockedCampaign</code>函數，可以明顯看出審批邏輯有缺陷。授予鎖定活動隨時轉出代幣的能力與預期行為相矛盾。這項設計缺陷是 HedgeyFinance 漏洞的根本原因。</p><h2>學過的知識</h2><p>Hedgefinance 漏洞凸顯了未能在智能合約中仔細管理代幣批准的嚴重後果。以下是重點：</p><ul><li><p><strong>批准就是權力：</strong>在 DeFi 系統中，批准合約通常意味著賦予其轉移代幣的權力。像直接發送資金一樣謹慎對待批准。</p></li><li><p><strong>完成後撤銷：</strong>與智能合約的互動完成後，認真撤銷不再需要的任何批准。這限制了潛在的攻擊面。</p></li></ul><div><div><div><p>感謝您閱讀 Verichains！免費訂閱以接收新帖子並支持我的工作。</p></div><div><div></div><div></div></div></div></div>

批准錯誤漏洞：分析 HedgeyFinance 攻擊

今天，孫宇晨在X發文稱："FF電動車全部搭載波場區塊鏈，唯一使用TRX作為電動車支付手段，人臉識別掃碼，大家感覺這個思路如何。"
結果，下面的回覆大量都是建議：賈總髮幣，不用搞IP商業化了，直接下週回國。
賈躍亭需要發幣嗎？不需要啊。
賈躍亭的法拉第未來雖然車子沒有生產出來，美股是有的，代碼是FFIE，雖然有傳言要被退市。
昨晚，法拉第未來的股票FFIE直接拉昇了307%。目前，股票市值在1200...

賈躍亭美股FFIE爆拉307%，SOL鏈同名MEME幣爆拉9910%，KittyFi概念還在持續

Swissblock 表示，美國零售銷售低迷和通脹報告疲軟為加密貨幣的下一輪上漲鋪平了道路。

通脹數據疲軟刺激加密貨幣上漲，比特幣觸及 66,000 美元

NEAR Protocol（NEAR）價格預計未來交易時段將出現牛市，前提是它能夠先突破關鍵阻力位。
然而，NEAR 持有者和加密貨幣市場正在發出信號…