×
Array
(
[fid] => 6980
[description] =>
[password] =>
[icon] =>
[redirect] =>
[attachextensions] =>
[creditspolicy] => Array
(
[post] => Array
(
[usecustom] => 1
[cycletype] => 1
[cycletime] => 0
[rewardnum] => 75
[extcredits1] => 0
[extcredits2] => 0
[extcredits3] => 0
[extcredits4] => 0
[extcredits5] => 0
[extcredits6] => 0
[extcredits7] => 0
[extcredits8] => 0
[rid] => 1
[fid] => 6980
[rulename] => 发表主题
[action] => post
[fids] => 32,52,67,447,1120,1151,1156,6750,6762,6763,6766,6769,6772,6773,6787,6796,6808,6809,6810,6813,6814,6820,6829,6830,6846,6856,6864,6865,6827,6930,6931,6776,6858,6880,6764,6932,6871,6758,6905,1116,6788,6812,6798,6736,6759,6842,6966,6767,6828,6924,6935,6936,6938,6940,6941,6826,6909,6803,6919,6911,6908,6881,6920,6912,6913,6921,6925,6922,6789,6818,6819,6872,6928,6969,6889,6888,6917,6939,6947,6961,6937,6943,6970,6869,6900,6902,6783,6817,1111,6870,6821,6951,6876,6952,6954,6960,6942,6910,6949,6962,6963,6964,6927,6926,6973,6728,6929,6874,6894,6896,6885,6857,6868,1113,6778,56,6844,6878,6802,6933,6811,6923,6877,6875,6918,6892,6757,6832,6833,6795,6793,6848,6837,6849,6850,6851,6852,6853,6854,6863,6882,6836,6790,6838,6794,6791,6873,555,6895,6934,6958,6944,6945,6907,6779,6886,6950,6904,6956,6862,6957,6855,6955,6959,6914,6965,6971,6972,6953,6975,6976,6799,6974,6824,6815,6891,6866,6979,6977,6765,6903,6948,6845,6879,1121,6980
)
[reply] => Array
(
[usecustom] => 1
[cycletype] => 4
[cycletime] => 0
[rewardnum] => 0
[extcredits1] => 0
[extcredits2] => 0
[extcredits3] => 0
[extcredits4] => 0
[extcredits5] => 0
[extcredits6] => 0
[extcredits7] => 0
[extcredits8] => 0
[rid] => 2
[fid] => 6980
[rulename] => 发表回复
[action] => reply
)
[digest] => Array
(
[usecustom] => 1
[cycletype] => 4
[cycletime] => 0
[rewardnum] => 0
[extcredits1] => 0
[extcredits2] => 0
[extcredits3] => 0
[extcredits4] => 0
[extcredits5] => 0
[extcredits6] => 0
[extcredits7] => 0
[extcredits8] => 0
[rid] => 3
[fid] => 6980
[rulename] => 加精华
[action] => digest
)
)
[formulaperm] => a:5:{i:0;s:0:"";i:1;s:0:"";s:7:"message";s:0:"";s:5:"medal";N;s:5:"users";s:0:"";}
[moderators] =>
[rules] =>
[threadtypes] => Array
(
[status] => 1
[required] => 0
[listable] => 0
[types] => Array
(
)
)
[threadsorts] => Array
(
)
[viewperm] =>
[postperm] =>
[replyperm] =>
[getattachperm] =>
[postattachperm] =>
[postimageperm] =>
[spviewperm] =>
[seotitle] =>
[keywords] =>
[seodescription] =>
[supe_pushsetting] =>
[modrecommend] => Array
(
[open] => 0
[num] => 10
[imagenum] => 0
[imagewidth] => 300
[imageheight] => 250
[maxlength] => 0
[cachelife] => 0
[dateline] => 0
)
[threadplugin] => Array
(
)
[replybg] =>
[extra] => a:2:{s:9:"namecolor";s:0:"";s:9:"iconwidth";s:0:"";}
[jointype] => 0
[gviewperm] => 0
[membernum] => 0
[dateline] => 0
[lastupdate] => 0
[activity] => 0
[founderuid] => 0
[foundername] =>
[banner] =>
[groupnum] => 0
[commentitem] =>
[relatedgroup] =>
[picstyle] => 0
[widthauto] => 0
[noantitheft] => 0
[noforumhidewater] => 0
[noforumrecommend] => 0
[livetid] => 0
[price] => 0
[fup] => 6974
[type] => sub
[name] => 币圈资讯
[status] => 1
[displayorder] => 0
[styleid] => 0
[threads] => 50922
[posts] => 50990
[todayposts] => 0
[yesterdayposts] => 0
[rank] => 61
[oldrank] => 59
[lastpost] => 2688723 美国2024年大选已花费147亿美元，或为史上最贵 1730688420 比推快讯
[domain] =>
[allowsmilies] => 1
[allowhtml] => 1
[allowbbcode] => 1
[allowimgcode] => 1
[allowmediacode] => 0
[allowanonymous] => 0
[allowpostspecial] => 1
[allowspecialonly] => 0
[allowappend] => 0
[alloweditrules] => 0
[allowfeed] => 0
[allowside] => 0
[recyclebin] => 1
[modnewposts] => 0
[jammer] => 0
[disablewatermark] => 0
[inheritedmod] => 0
[autoclose] => 0
[forumcolumns] => 0
[catforumcolumns] => 0
[threadcaches] => 0
[alloweditpost] => 1
[simple] => 16
[modworks] => 0
[allowglobalstick] => 1
[level] => 0
[commoncredits] => 0
[archive] => 0
[recommend] => 0
[favtimes] => 0
[sharetimes] => 0
[disablethumb] => 0
[disablecollect] => 0
[ismoderator] => 0
[threadtableid] => 0
[allowreply] =>
[allowpost] =>
[allowpostattach] =>
)
|
被盗1亿美元的Harmony 验证者节点安全如何保障？
[复制链接]
|
当前离线
经验:
天策币:
活跃币:
策小分:
总在线: 分钟
本月在线: 分钟
|
|
|
2022年6月24日，成都链安链必应-区块链安全态势感知平台舆情监测显示，由Layer1公链Harmony开发的以太坊与Harmony间的资产跨链桥Horizon遭到攻击，损失金额约为1亿美元。目前Harmony官方已通知交易所并暂停了Horizon跨链桥。成都链安安全团队对此事件进行了分析，现与大家分享。
Harmony Bridge是一个跨链桥项目，由五个验证者节点进行操作验证，本次攻击主要原因是由于两个验证者节点的私钥疑似泄露，导致合约的confirmTransaction函数被成功调用。
#攻击过程
攻击者地址：
0x0d043128146654C7683Fbf30ac98D7B2285DeD00
私钥疑似泄露地址：
0xf845A7ee8477AD1FB4446651E548901a2635A915
0x812d8622C6F3c45959439e7ede3C580dA06f8f25
被攻击合约：
0x715cdda5e9ad30a0ced14940f9997ee611496de6
示例哈希：
0x6e5251068aa99613366fd707f3ed99ce1cb7ffdea05b94568e6af4f460cecd65
被攻击的transactionId:21106-21118(eth),120515-120518(bsc)
私钥泄露地址0x812d......8f25地址调用了0x715c......6de6合约的confirmTransaction函数进行操作验证，此处我们以被攻击的transactionId：21107进行分析。
可以发现在本次交易中，isConfirmed的验证返回为true。
但是我们在合约中进行验证者节点查询会发现，虽然owner有五个，但是仅有两名验证者进行了验证。
攻击者就利用这两个验证者节点成功使用external_call获取了相应的代币，并反复利用此攻击来获利。
后续项目方通过transactionId为21126的交易（BSC上为120531）将验证者节点confirm通过的数量从2改为了4。
#资金追踪
本次攻击事件以太坊上损失了85,867个ETH，990个AAVE和78,500,000个AAG，BSC上损失了5,000个BNB和640,000个BUSD，共计约100,428,116美元，目前被盗资金还保存在攻击者地址。成都链安将用链必追对被盗资金进行持续追踪。
#事件总结
这次攻击事件中，攻击者利用了验证者节点验证通过需求数量较少的情况，利用两个验证者节点从而盗取了上亿美金的资产。建议项目方在设计验证者节点验证数量需求尽量选择较多节点，并且做好验证者节点的节点安全。此外建议项目上线前选择专业的安全审计公司进行全面的安全审计，规避安全风险。
来源：金色财经 |
|
|
|
|
|
|
|
|
|
