ERC2771 Multicall arbitrary address spoofing attack analysis and recurrence

describe：

This is a very interesting smart contract security vulnerability. After investigation, it was found that multiple tokens on the main network are under attack.OpenZeppelin received a security disclosure from the thirdweb team. It was about the presence of an issue arising from a problematic integration of two specific standards: ERC-2771 and Multicall.

source:

X Scam Sniffer | Web3 Anti-Scam

X Phalcon

Attacker address analysis:

I only give an example of the address where the attack first occurred. This attack behavior was later imitated by other hacker addresses and involved multiple chains: such as BSC Polyon….

ETH chain

https://etherscan.io/tx/0xecdd111a60debfadc6533de30fb7f55dc5ceed01dfadd30e4a7ebdb416d2f6b6

hacker: https://etherscan.io/address/0xfde0d1575ed8e06fbf36256bcdfa1f359281455a

Attack contract used by hackers: https://etherscan.io/address/0x6980a47bee930a4584b09ee79ebe46484fbdbdd0

Decompile the attack contract:

https://library.dedaub.com/decompile?md5=b01e758fad75dad198dfbcc4f2e52e35

Polygon chain：

https://polygonscan.com/tx/0x1b0e27f10542996ab2046bc5fb47297bcb1915df5ca79d7f81ccacc83e5fe5e4

hacker:https://polygonscan.com/address/0x0a4311b6a2e6dbc5b6a1a0c2bd77b3d83f220a1c

Attack contract used by: hackers:https://polygonscan.com/address/0x1a8c8706f51dc21f455ff1b44f5678ede8faabb7

Decompile the attack contract:

https://library.dedaub.com/decompile?md5=a572dd9666a813f2d1e82c4e3932af30

Platform where the vulnerability occurs:

ERC-2771: Secure Protocol for Native Meta Transactions (ethereum.org)

Utilities — OpenZeppelin Docs

Affected coins:

It affects many tokens, such as:

ETH mainnet：

For example ：HXA WFCA TIME(https://etherscan.io/tx/0xecdd111a60debfadc6533de30fb7f55dc5ceed01dfadd30e4a7ebdb416d2f6b6) NAME(https://etherscan.io/tx/0x4ed1ec3d33c297560ed8f5a782b54d2c52adb20155c543fb64ba9065e45c046c) 等

polygon：

For example：Swop(https://polygonscan.com/tx/0x1b0e27f10542996ab2046bc5fb47297bcb1915df5ca79d7f81ccacc83e5fe5e4) (hack:https://polygonscan.com/address/0x0a4311b6a2e6dbc5b6a1a0c2bd77b3d83f220a1c) Attack contract：(https://polygonscan.com/address/0x1a8c8706f51dc21f455ff1b44f5678ede8faabb7)

https://polygonscan.com/txs?a=0x5dbc7b840baa9dabcbe9d2492e45d7244b54a2a0

Vulnerability analysis:

On-chain analysis ：

Here is an example of TIME

Attacked contract address [Time (TIME) Token Tracker | Etherscan](https://etherscan.io/token/0x4b0e9a7da8bab813efae92a6651019b8bd6c0a29)

hacker: [ERC2771 Exploiter 2 | Address 0xfde0d1575ed8e06fbf36256bcdfa1f359281455a | Etherscan](https://etherscan.io/address/0xfde0d1575ed8e06fbf36256bcdfa1f359281455a)

Get S7iter’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Attack contract used by hacker: [MEV Bot: 0x698…DD0 | Address 0x6980a47bee930a4584b09ee79ebe46484fbdbdd0 | Etherscan](https://etherscan.io/address/0x6980a47bee930a4584b09ee79ebe46484fbdbdd0)

Phalcon visual analytics:

https://explorer.phalcon.xyz/tx/eth/0x4ed1ec3d33c297560ed8f5a782b54d2c52adb20155c543fb64ba9065e45c046c

More details: https://www.metasleuth.io/result/eth/0xecdd111a60debfadc6533de30fb7f55dc5ceed01dfadd30e4a7ebdb416d2f6b6

The actions of hackers can be divided into the following:

1: 0xfde0d1575ed8e06fbf36256bcdfa1f359281455a spent 55Wei to deploy MEVbot (attack contract), and then the attack contract exchanged 5 ETH for 5 WETH

Two: Use these 5 WETH to exchange for 345,539,9346 Time coins through Uniswap.

Three: Then call the execute function and construct malicious data to call the multicall function of the token contract.

The token contract will execute the burn function of the token contract in delegateCall based on the malicious data passed in by the attacker, burning 62,227,259,510 Time coins in the pool address (the so-called driving the tokens into 0x00).

Four: Then the token price rose instantly, and then the hacker sold 3,455,399,346 Time coins through uniswap, obtaining approximately 94 WETH, which was then exchanged for approximately 94 ETH. (This operation process of Mevbot gives Flashbots about 5 Eth to ensure fast and stable transactions).

Vulnerability code principle analysis：

Forward.sol:

In the execute function, after verifying the signature of ‘req.from’, ‘cal’l will be used to interact with ;req.to’ (token address). The ‘req.data’ passed in by the attacker is：

0xac9650d8000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000003842966c680000000000000000000000000000000000000000c9112ec16d958e8da8180000760dc1e043d99394a10605b2fa08f123d60faf840000000000000000

Because 0xac9650d8 is the function signature of the multicall function, the multicall function of the token contract will be called, and the data value passed in by the multicall function is:

0x42966c680000000000000000000000000000000000000000c9112ec16d958e8da8180000760dc1e043d99394a10605b2fa08f123d60faf84

So the data passed in is:

0xac9650d8
0000000000000000000000000000000000000000000000000000000000000020
0000000000000000000000000000000000000000000000000000000000000001
0000000000000000000000000000000000000000000000000000000000000020
0000000000000000000000000000000000000000000000000000000000000038
0x42966c680000000000000000000000000000000000000000c9112ec16d958e8da8180000760dc1e043d99394a10605b2fa08f123d60faf84

Why is there no req.from in the data value passed into the multicall function? The attacker sets a data with an offset of 38 and a length of 1 byte in the calldata. This is because the EVM will truncate the actual required value based on the incoming offset when processing the call call. So here, the attacker sets the offset to 38, which means that the first 38 bytes are truncated and only the 39th byte is taken. The 39th byte is a non-zero value, which is interpreted as true, and the value length is 1, so the data value just intercepted is

42966c68000000000000000000000000000000000000000c9112ec16d958e8da8180000760dc1e043d99394a10605b2fa08f123d60faf84

For details, please refer to:EVM Codes — An Ethereum Virtual Machine Opcodes Interactive Reference

Because 0x42966c68 is the function signature of the burn function, the burn function of the token contract will be called via delegatecall based on the data value constructed by the attacker.:

MulticallUpgradeable.sol

The _msgSender() function is overridden by the ERC-2771 library. (Because the current code has been modified, I will call NAME to see)

Let’s take a look at [ERC-2771: Secure Protocol for Native Meta Transactions (ethereum.org)](https://eips.ethereum.org/EIPS/eip-2771)

can be found

So the final value returned by _msgSender() is the last 20 bytes of the incoming calldata “0x760dc1e043d99394a10605b2fa08f123d60faf84”

0x760dc1e043d99394a10605b2fa08f123d60faf84[Uniswap V2: TIME 40 | Address 0x760dc1e043d99394a10605b2fa08f123d60faf84 | Etherscan](https://etherscan.io/address/0x760dc1 e043d99394a10605b2fa08f123d60faf84) is the pool address.