According to a cybersecurity firm that warned on the matter Sunday, Ethereum Hard fork that continues with the Proof of Work mechanism ETHPoW There was a hacker attack on it.
Attackers Performed Transaction in Proof of Stake Chain on Proof of Work
The attackers transferred an extra 200 ETHW tokens by repeating the transaction on the Proof of Stake Blockchain.
Security company BlockSec said in a statement on Twitter:
“The attacker (0x82fae) first transferred 200 WETH over the omni bridge of the Gnosis chain and then repeated the same thing on the PoW chain, receiving an extra 200 ETHW.”
The company claimed that the attack occurred because the bridge’s cross-chain message did not properly verify the chain identity.
1/ Alert | BlockSec detected that exploiters are replaying the message (calldata) of the PoS chain on @EthereumPow. The root cause of the exploitation is that the bridge doesn’t correctly verify the actual chainid (which is maintained by itself) of the cross-chain message.
— BlockSec (@BlockSecTeam) September 18, 2022
The ETHPoW Blockchain developer team said the attack exploited the bridge’s contract vulnerability, not the blockchain itself.
“ETHW itself implemented EIP-155 and the ETHPoS to ETHPoS replay attack that ETHW Core’s security engineers had previously planned did not occur,” the ETHW Core developers wrote in a Medium post.
The developer team also said that it has been trying to contact Omni Bridge since Saturday to provide information about the risks. Omni Bridge has not yet responded to a request for comment.
The developers said in their statement:
“We have contacted the bridge in every way and informed them of the risks. Bridges need to correctly verify the true ChainID of cross-chain messages.”
The ETHPoW fork on the Proof of Work Ethereum Blockchain went live this week after Merge. According to data from TradingView, the token has dropped more than 35% after the news of the exploit on Sunday morning.
*Not investment advice.
For exclusive news, analytics and on-chain data Telegram our group, twitter our account and YouTube Follow our channel now! Moreover Android and iOS Start live price tracking right now by downloading our apps!