SlowMist: The attacker re-enters the Lendf.Me contract through the "supply()" function to achieve a re-entry attack
2020-04-19 08:29
星球日报讯 慢雾安全团队发文跟进“DeFi平台Lendf.Me被黑”一事的具体原因及防御建议。文章分析称,通过将交易放在bloxy.info上查看完整交易流程,可发现攻击者对Lendf.Me进行了两次“supply()”函数的调用,但是这两次调用都是独立的,并不是在前一笔“supply()”函数中再次调用“supply()”函数。紧接着,在第二次“supply()”函数的调用过程中,攻击者在他自己的合约中对Lendf.Me的“withdraw()”函数发起调用,最终提现。
慢雾安全团队表示,不难分析出,攻击者的“withdraw()”调用是发生在transferFrom函数中,也就是在Lendf.Me通过transferFrom调用用户的“tokensToSend()”钩子函数的时候调用的。很明显,攻击者通过“supply()”函数重入了Lendf.Me合约,造成了重入攻击。
最热快讯
资讯热榜
日榜
周榜
Crypto Lawyer Khurram Dara Considers Running for New York Attorney General
Exodus Movement added 29 BTC in July, bringing its total holdings to 2,087.
Planet Evening News | August 5th
Coinbase plans to raise $2 billion through convertible note offering
Galaxy Digital Releases Q2 Financial Report: Net Revenue Reaches $30.7 Million in Q2, Holds $1.2 Billion in Cash and Stablecoins
Binance Alpha will launch TaleX (X) on August 7th