UXLink Implements New Ethereum Contract Following Security Breach

According to Cointelegraph, decentralized social platform UXLink has announced the deployment of a new Ethereum contract after a security breach in its multisignature wallet led to the unauthorized minting of billions of tokens, significantly impacting the value of its native asset. The new smart contract, which has passed a security audit, will be launched on the Ethereum mainnet. To prevent future incidents, the project has removed the mint-burn function from the contract. The breach, confirmed by UXLink on Tuesday, resulted in a substantial amount of cryptocurrency being transferred to exchanges. Estimates of the financial losses vary, with Cyvers Alerts suggesting at least $11 million was stolen, while Hacken estimates the figure to be over $30 million. This incident underscores the importance of addressing smart contract security vulnerabilities. Marwan Hachem, co-founder and CEO of Web3 security firm FearsOff, emphasized the risks associated with advancing without adequate security measures. The attackers exploited a vulnerability in UXLink’s multisignature wallet, initially minting 2 billion UXLINK tokens and causing the token's price to plummet by 90%, from $0.33 to $0.033. Hacken estimates that nearly 10 trillion tokens were created during the breach. Hachem explained that the breach was due to a delegate call vulnerability, allowing the hacker to execute arbitrary code and gain administrative control over the contract, leading to the unauthorized minting of tokens. Hachem highlighted design flaws in UXLink’s setup, including insufficient protection against delegate call exploits and inadequate controls over token minting. He stressed the importance of implementing standard safeguards, such as timelocks for sensitive actions and renouncing minting privileges once tokens are launched. Hardcoding supply caps directly into smart contracts could also mitigate the risk of unauthorized token creation. Operationally, Hachem advocated for independent reviews and ongoing transparency, urging projects to make wallet addresses public and require multiple signers for transactions. He noted that even widely used tools like multisignature wallets should not be considered infallible and emphasized the need for decentralized governance and emergency stops for critical functions. Hachem concluded that UXLink’s incident demonstrates the necessity of robust and continuous security measures to maintain community trust.