Safeheron: MPC wallets interacting with Web3 applications based on the StarkEx protocol will be attacked, and the vulnerability is currently being patched

According to Cointelegraph, Safeheron, a one-stop open source self-hosting service provider, stated that some multi-signature wallets will be attacked by Web3 applications using the StarkEx protocol. This vulnerability affects MPC wallets that interact with StarkEx-based applications (such as dYdX, Fireblocks) . Safeheron is currently working with application developers to patch the vulnerability. When the MPC wallet interacts with such applications to obtain "stark_key_signature" and/or "api_key_signature", it can "bypass the security protection of the private key in the MPC wallet", and the attacker can place an order, transfer assets on Layer 2, and perform other unauthorized transactions. authorized transactions. Safeheron hinted that the flaw would only leak users' private keys to wallet providers. Safeheron said it is working with several Web3 application developers including Fireblocks, Fordefi and StarkWare to patch the vulnerability. StarkEx is StarkWare's scaling engine that uses zero-knowledge proofs to secure the network. When users connect to the StarkEx app for the first time, they derive a STARK key using their normal Ethereum wallet. Safeheron said it was this process that led to the compromise of the MPC wallet’s keys.