Archived tweet

Tweet by BlockSec Phalcon:

Wanchain @wanchain_org Cardano bridge was reportedly being attacked, with ~515M $NIGHT drained from the bridge Treasury. Our initial investigation suggests that the root cause seems to be a non-injective signed-message encoding in the TreasuryCheck validator. The signed message is built by raw-concatenating 14 variable-length redeemer fields (via `AppendByteString` fold) without delimiters or length prefixes. Different field-value tuples can produce the same byte string — and therefore the same hash and a valid signature reuse. We verified this by decompiling the on-chain Plutus V2 bytecode (pic 1) and decoding the attack redeemer from the exploit TX (pic 2). The same on-chain bytecode also contains a `SerialiseData` builtin — but it is only used on the output-datum matching path, not in the signature-hash construction. Using `Sha3_256(SerialiseData(...))` instead would have provided unambiguous CBOR-encoded field boundaries, preventing this class of field-splitting signature reuse. Attack TX: cardanoscan.io/transaction/0a … Tweeted at Jul 20

Tweet #1

Image #1:

Image

Image #2:

Image

Links: