On April 19, 2024, HedgeyFinance suffered an exploit resulting in an estimated loss of $45 million. A design error in the Campaign contract permitted an attacker to directly steal a substantial amount of assets. In this blog, we will analyze the first attack on the Ethereum network to help users prevent similar vulnerabilities in their own projects.

<p>On April 19, 2024, HedgeyFinance suffered an exploit resulting in an estimated loss of $45 million. A design error in the Campaign contract permitted an attacker to directly steal a substantial amount of assets.</p><p>In this blog, we will analyze the first attack on the Ethereum network to help users prevent similar vulnerabilities in their own projects.</p><div><div><div><p>Thanks for reading Verichains! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div><h2>Overview</h2><p>Attacker:</p><p><a href="https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2" rel="nofollow">https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2</a></p><p>Vulnerable Contract:</p><p><a href="https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511" rel="nofollow">https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511</a></p><p>Transaction attack:</p><p><a href="https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517" rel="nofollow">https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517</a></p><p><a href="https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739" rel="nofollow">https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739</a></p><h2>Exploit Analysis</h2><p>Following the first transaction, the attack methodology was surprisingly straightforward. The attacker borrowed a large amount of USDC to create a locked campaign and then immediately canceled it.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fa957e94c-6cf2-4dee-8589-ef60fb833a70_2496x914.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/a61c9e226be8b37f1e8e5bf2dd064056.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>In the second transaction, the attacker triggered the contract to transfer USDC directly from the HedgeyFinance contract to their own address.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F90bd4a27-82f2-4c36-84f3-3299c517b658_2482x284.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/5b334a1f9367df61b976daf66c7cfd21.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>The simplicity of the second transaction strongly suggests that the root cause of the exploit lies in the <code>createLockedCampaign</code> and <code>cancel</code> functions from step 1.</p><p>Investigate the createLockedCampaign function</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F572423da-93c1-4561-ba4b-babe23cbbe11_1940x1220.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/80986f5e04f7ad9ca0f32be5a4cd8981.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>During the creation of a locked campaign, the owner has the ability to designate a tokenLocker. This tokenLocker, upon receiving approval, can then transfer out all the tokens associated with the newly created campaign. This behavior appears to be a potential vulnerability.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F37e738ba-6e28-46e4-8518-44e28ea9b539_1978x348.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/f4a244bc78e3d917fae0df39c57e80ce.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>While the function comment indicates an intent to prevent anyone from claiming additional tokens, it appears to only restrict access to reward tokens. Crucially, the function doesn't revoke approval granted in a previous step. This oversight allows the attacker to withdraw all staked tokens within the campaign while retaining the approval from the earlier step.</p><p>With this lingering approval, the attacker can easily transfer tokens out of the contract to any desired location.</p><p>By analyzing the <code>createLockedCampaign</code> function in reverse, it becomes clear that the approval logic is flawed. Granting the ability for a locked campaign to transfer tokens out at any time contradicts the expected behavior. This design flaw is the root cause of the HedgeyFinance exploit.</p><h2>Lesson learned</h2><p>The HedgeyFinance exploit highlights the severe consequences of failing to manage token approvals carefully within smart contracts. Here are key takeaways:</p><ul><li><p><strong>Approval is Power:</strong> In DeFi systems, granting approval to a contract often means giving it the power to transfer your tokens. Treat approvals with the same caution as sending funds directly.</p></li><li><p><strong>Revoke When Done:</strong> When an interaction with a smart contract is complete, diligently revoke any approvals that are no longer required. This limits the potential attack surface.</p></li></ul><div><div><div><p>Thanks for reading Verichains! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div>

Approval Error Vulnerability: Analyzing the HedgeyFinance Attack

2024 年 4 月 19 日，HedgeyFinance 遭受攻擊，估計損失 4500 萬美元。Campaign 合約中的設計錯誤允許攻擊者直接竊取大量資產。在本博客中，我們將分析對以太坊網絡的第一次攻擊，以幫助用戶防止自己的項目中出現類似的漏洞。

<p>2024 年 4 月 19 日，HedgeyFinance 遭受攻擊，造成估計損失 4,500 萬美元。 Campaign 合約中的設計錯誤允許攻擊者直接竊取大量資產。</p><p>在本部落格中，我們將分析以太坊網路上的第一次攻擊，以幫助使用者預防自己專案中的類似漏洞。</p><div><div><div><p>感謝您閱讀 Verichains！免費訂閱以接收新帖子並支持我的工作。</p></div><div><div></div><div></div></div></div></div><h2>概述</h2><p>攻擊者：</p><p> <a href="https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2" rel="nofollow">https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2</a></p><p>脆弱合約：</p><p> <a href="https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511" rel="nofollow">https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511</a></p><p>交易攻擊：</p><p> <a href="https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517" rel="nofollow">https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517</a></p><p> <a href="https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739" rel="nofollow">https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739</a></p><h2>漏洞利用分析</h2><p>在第一筆交易之後，攻擊方法出乎意料地簡單。攻擊者藉用大量USDC來建立鎖定活動，然後立即取消活動。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fa957e94c-6cf2-4dee-8589-ef60fb833a70_2496x914.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/a61c9e226be8b37f1e8e5bf2dd064056.jpg" alt=""></source></picture><div></div></div></figure></div><p>在第二筆交易中，攻擊者觸發合約將USDC直接從 HedgeyFinance 合約轉移到自己的地址。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F90bd4a27-82f2-4c36-84f3-3299c517b658_2482x284.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/5b334a1f9367df61b976daf66c7cfd21.jpg" alt=""></source></picture><div></div></div></figure></div><p>第二筆交易的簡單性強烈表明，該漏洞利用的根本原因在於步驟 1 中的<code>createLockedCampaign</code>和<code>cancel</code>函數。</p><p>研究 createLockedCampaign 函數</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F572423da-93c1-4561-ba4b-babe23cbbe11_1940x1220.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/80986f5e04f7ad9ca0f32be5a4cd8981.jpg" alt=""></source></picture><div></div></div></figure></div><p>在建立鎖定活動期間，擁有者可以指定 tokenLocker。該 tokenLocker 在獲得批准後，可以轉出與新創建的活動相關的所有代幣。此行為似乎是一個潛在的漏洞。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F37e738ba-6e28-46e4-8518-44e28ea9b539_1978x348.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/f4a244bc78e3d917fae0df39c57e80ce.jpg" alt=""></source></picture><div></div></div></figure></div><p>雖然函數註釋表明意圖阻止任何人要求額外代幣，但它似乎僅限制對獎勵代幣的存取。至關重要的是，該功能不會撤銷上一步中授予的批准。這種疏忽允許攻擊者撤回活動中所有質押的代幣，同時保留先前步驟的批准。</p><p>透過這種持續的批准，攻擊者可以輕鬆地將代幣從合約轉移到任何所需的位置。</p><p>透過逆向分析<code>createLockedCampaign</code>函數，可以明顯看出審批邏輯有缺陷。授予鎖定活動隨時轉出代幣的能力與預期行為相矛盾。這項設計缺陷是 HedgeyFinance 漏洞的根本原因。</p><h2>學過的知識</h2><p>Hedgefinance 漏洞凸顯了未能在智能合約中仔細管理代幣批准的嚴重後果。以下是重點：</p><ul><li><p><strong>批准就是權力：</strong>在 DeFi 系統中，批准合約通常意味著賦予其轉移代幣的權力。像直接發送資金一樣謹慎對待批准。</p></li><li><p><strong>完成後撤銷：</strong>與智能合約的互動完成後，認真撤銷不再需要的任何批准。這限制了潛在的攻擊面。</p></li></ul><div><div><div><p>感謝您閱讀 Verichains！免費訂閱以接收新帖子並支持我的工作。</p></div><div><div></div><div></div></div></div></div>

批准錯誤漏洞：分析 HedgeyFinance 攻擊

本屆 Binance 區塊鏈周最大的期待終於來了。剛結束 4 個月獄中生活的 Binance 創始人趙長鵬（CZ）現身主會場，並聊了一些關於獄中生活、Binance、教育項目，以及 AI 的話題。這也是 CZ 出獄後的首次現身。
43 億美元罰款、疊加 4 個月的美國牢獄生活後，為了自由付出極大代價的 CZ 看起來比較 chill，手臂線條比之前更加明顯。在今年比特幣這條 7 萬美元歷史新高的路上...

出獄後CZ首次現身談監獄生活與未來：做教育需要的時間，我現在有的是

解套之旅，從Meme自救開始。
最初吸引我進入加密圈，就是Bitcoin的暴富故事和每年披薩節的扼腕嘆息。
曾經，我作為一個堅定的主流幣持有者，只用幣安和OKEx這兩個交易所，大樹底下好乘涼，覺得只有在這些平臺上買的幣才靠譜。雖然我不是全職炒幣的，但我喜歡關注熱點。偶然的機會，在$Bome和$Pandora上賺了一些錢，並認為自己是天才交易員級別的人物了。
但隨著時間推移，情況變了。
每次比特幣上...

操盤實錄｜關於我換倉 Meme，實現 2 周收益 40 萬美金的真實故事

Solana meme幣總市值創歷史新高
'SOL'必須翻譯為'SOL'。
'AR'必須翻譯為'AR'。
'meme'必須翻譯為'meme'。
'Solana'必須翻譯為'Solana'。