Are you getting the most out of your AWS investment? Get your free AWS Well-Architected Assessment.

2021 Fillmore Street #1128

}

24/7 solutions

Technical Analysis of the $31 Million Dollar Ethereum Hack

Here’s an interesting analysis of the $31 Million Ethereum Hack. http://medium.freecodecamp.org/a-hacker-stole-31m-of-ether-how-it-happened-and-what-it-means-for-ethereum-9e5dc29e33ce From a technical standpoint, it appears as though the software developers who built the Parity wallet put in a catch all function that enables unknown functions that are payable, that send you Ether, to default to depositing the Ether. function() payable { //msg.value is […]

Here’s an interesting analysis of the $31 Million Ethereum Hack.
http://medium.freecodecamp.org/a-hacker-stole-31m-of-ether-how-it-happened-and-what-it-means-for-ethereum-9e5dc29e33ce

Ethereum Theft
From a technical standpoint, it appears as though the software developers who built the Parity wallet put in a catch all function that enables unknown functions that are payable, that send you Ether, to default to depositing the Ether.

function() payable {
  //msg.value is the amount of Ether
  if (msg.value > 0) {
    Deposit(msg.sender, msg.value);
  }
  throw;
}


In the Parity wallet, the developers took this functionality a step further, and wrote code to state if the value of the Ether is equal to 0 and the length of the msg is greater than zero, then delegate the call to the Wallet.

function() payable {
  //msg.value is the amount of Ether
  if (msg.value > 0) {
    Deposit(msg.sender, msg.value);
  }
  else if (msg.data.length > 0) {
    //if the msg data has data and msg.value is equal to 0, then delegate
    //the call to the Wallet Library's version of this function.
    _walletLibrary.delegatecall(msg.data);
  }
}


So what happened?
The thieves understood the vulnerability vector. They invoked the catch all function with the initWallet function. This call was not implemented in the contract, but was implemented in the wallet.
The initWallet function looks like the following:

function initWallet(address[/fusion_builder_column][fusion_builder_column type="1_1" background_position="left top" background_color="" border_size="" border_color="" border_style="solid" spacing="yes" background_image="" background_repeat="no-repeat" padding="" margin_top="0px" margin_bottom="0px" class="" id="" animation_type="" animation_speed="0.3" animation_direction="left" hide_on_mobile="no" center_content="no" min_height="none"][] _owners, uint _required, uint _daylimit) {
  initDaylimit(_daylimit);
  initMultiowned(_owners, _required);
}


The key piece here is the _owners. They passed in the address of the owners to the wallet. In effect, the thieves initialized the wallet so they became the owners. They drained the tokens from the wallet, and said bye bye.

Joel Garcia

Joel Garcia

Joel Garcia has been building AllCode since 2015. He’s an innovative, hands-on executive with a proven record of designing, developing, and operating Software-as-a-Service (SaaS), mobile, and desktop solutions. Joel has expertise in HealthTech, VoIP, and cloud-based solutions. Joel has experience scaling multiple start-ups for successful exits to IMS Health and Golden Gate Capital, as well as working at mature, industry-leading software companies. He’s held executive engineering positions in San Francisco at TidalWave, LittleCast, Self Health Network, LiveVox acquired by Golden Gate Capital, and Med-Vantage acquired by IMS Health.

Related Articles

Traditional IT vs. AWS – How Small Businesses can Benefit

Traditional IT vs. AWS – How Small Businesses can Benefit

AWS solutions can accomplish a variety of problems and tasks including IT needs. Even smaller businesses that have a more limited scope that their businesses cover can look to find some way to upgrade their business operations through what Amazon has to offer. Though it may be intimidating and difficult to adapt to, there is more than enough reason to adopt AWS.

AWS Think Big with Small Business Program’s Competitive Edge

AWS Think Big with Small Business Program’s Competitive Edge

The Amazon Cloud can help alleviate most issues involving transitioning the cloud. Businesses of any scope can hope to build solutions that are scalable and adaptable to their industry of work. Smaller or minority-owned businesses may still struggle to stand out among bigger companies or make an AWS environment as efficient as possible with fewer funds to spend. To alleviate these burdens, Amazon has the Think Big With Small Business program available through their Public Sector partnership program.

AWS Think Big for Small Business, Data Analytics, and Business Intelligence

AWS Think Big for Small Business, Data Analytics, and Business Intelligence

The AWS Think Big for Small Business Program is an outreach program designed to provide small and/or minority-owned public sector organizations support in the form of business intelligence, technical expertise, and marketing strategies. With cloud-based solutions and experience, various public institutions globally have seen continued success in government, educational, and nonprofit sectors. While the funding provided can help significantly to meet business objectives, the expertise on navigating the cloud and how to extend outwards towards customers is just as critical.