Skip to main content

Security firm discovers $500M vulnerability in Tron multisig accounts

After reporting the vulnerability to Tron in February, the researchers highlighted that the issue was promptly addressed and resolved within a few days.

A research team at dWallet Labs has discovered a zero-day vulnerability in Tron multisig accounts, allowing an attacker to bypass the multisignature mechanism and sign transactions with a single signature.

In a technical breakdown post, the research team said the vulnerability could have impacted $500 million in assets held in Tron multisig accounts. This is because it allows any signer to “completely overcome the multisig security offered by TRON.”

As its name suggests, multisignature wallets require multiple signers defined in an account to approve transactions and move funds, allowing the creation of joint accounts in crypto. Each account signer holds their own keys and the account requires a certain threshold for approving transactions. 

According to the research team, the vulnerability with Tron’s multisig allows for generating many valid signatures. They wrote:

“We can bypass the multisig verification process by signing the same message with non-deterministic nonces of our choice. By doing so, we will be able to generate many valid different signatures for the same message by the same private key.”

According to the cybersecurity team, Tron ensures the signatures are unique instead of checking if the signers are unique. Because of this, signers can potentially “double vote” or sign twice. Omer Sadika, the CEO of dWallet Labs, said the fix was simple: verify the address instead of the number of signatures.

Sadika discussed the vulnerability in a thread. Source: Twitter

The researchers noted that the vulnerability was reported to Tron in February and fixed days after.

Related: Justin Sun issues apology after Sui LaunchPool clashes with Binance CEO

Cointelegraph reached out to Tron for comments but did not receive a response.

In other news, another decentralized finance protocol recently suffered a $7.5 million exploit. On May 28, blockchain security firm PeckShield reported that Arbitrum-based Jimbos Protocol was hacked, resulting in the loss of 4,000 Ether (ETH).

Magazine: US and China try to crush Binance, SBF’s $40M bribe claim



from https://ift.tt/gVIDPWB
https://ift.tt/8PINn5Y
Labels:

Comments

Post a Comment

Any questions, Please.

Popular posts from this blog

How to play and earn in CryptoKitties

CryptoKitties is a blockchain-based game where players can buy, sell and breed digital cats with unique attributes. Reminiscent of Tamagotchi and Pokémon, the wildly popular digital pets and creatures of the 1990s, CryptoKitties is a blockchain-based game where players can collect, trade and breed digital virtual cats. CryptoKitties was the first Ethereum-based game, and its popularity underscored many of the network’s scaling issues. This digital cat-breeding blockchain game caused quite a bit of congestion on the Ethereum blockchain, peaking in 2020. However, the game’s creators were able to address these issues. What is CryptoKitties? Launched in 2017, CryptoKitties was built by Dapper Labs, the company that uses blockchain technology to bring nonfungible tokens (NFTs) and new forms of digital engagement to fans around the world. CryptoKitties is also considered one of the world’s first-ever blockchain games. In the game, each one of the digital collectible cats possesses a
Post a Comment
Read more

Bitcoin dominance falls under 40%

While Bitcoin critics claim this means that BTC is losing its first-mover competitive advantage, others are anticipating the “altcoin season” is just around the corner, or might even be already underway. Bitcoin’s market dominance has continued to fall, bottoming out below 40% this week. That’s very close to the all-time low of 36.7% in Jan 2018 according to data from Tradingview. Bitcoin ( BTC ) market dominance refers to the ratio between BTC’s market cap and the total crypto market cap. It's not the first time dominance has dipped in 2021. Back in May, Cointelegraph reported that BTC had dipped to represent just 40.3% of the combined crypto asset capitalization, according to Coinmarketcap, and it neared the same level again in September.  Bitcoin critic and Europac chairman Peter Schiff tweeted about the event on Dec 29th, saying that it’s indicative that BTC is “losing its first-mover competitive advantage.” With over 16,000 alternative cryptos to choose from Bitcoin
Post a Comment
Read more

Five Bitcoin Price Charts Analyzing The Dramatic Q1 2022 Conclusion

There are only hours remaining until the Q1 2022 close in Bitcoin price action. With the important quarterly candle set to close tonight, let’s look at what technicals might say about the direction of the next quarter. Q1 2022 Comes To A Close For Bitcoin The first quarter of a year, often sets the tone for the year to come. In investments, a poor Q1 performance is indicative of a bad year ahead. Considering the fact that Bitcoin price is now above $45,000 after touching $32,000 this quarter, it is tough to say the performance has been “poor” by anything other than crypto standards. Related Reading | Bitcoin Weekly Momentum Flips Bullish For First Time In 2022 The cryptocurrency has recovered nearly 40% from the low, leaving a long wick behind. Such a long wick suggests that before the quarter came to a close, buyers stepped up in a major way. Buyers were able to step up in a larger capacity in Q1 2022 than bears were able to in the final quarter of last year. The bearish wick to cl
Post a Comment
Read more