Beosin EagleEye: The Socket protocol suffered a call injection attack by an attacker, causing losses exceeding US$3 million.

According to monitoring by Beosin's EagleEye security risk monitoring, early warning and blocking platform, the Socket protocol suffered a call injection attack by an attacker, resulting in the theft of a large number of authorized user funds. This attack is mainly due to unsafe call calls in the performAction function of the Socket contract. The function of this function is that the caller can exchange WETH into ETH, and the caller needs to exchange the WETH transferred into the contract into ETH through the WETH call, otherwise the balance check will not pass. It stands to reason that the call in the function can only call the withdraw function of the WETH contract, but the project team did not consider that the number of WETH transferred by the caller is 0, so the caller can call other specified functions in the call, and can pass Balance check. The attacker constructs calldata and calls the transferfrom of any token to transfer the tokens authorized by other users to the contract to the attacker's address. Currently, the attacker converts the stolen funds into ETH and saves them on the attacker's address. Beosin will conduct continuous monitoring of funds. Stolen funds storage address: https://eagleeye.space/address/0x50DF5a2217588772471B84aDBbe4194A2Ed39066.