2022 年 10 月 13 日，根据 Beosin 的 EagleEye Web3 安全监控平台，FTX 交易所遭到 gas 窃取攻击，被操纵支付所有 gas 费用，为黑客铸造大量 XEN 代币。
针对此次攻击，Coinlive 邀请新加坡 Web3 安全公司 Beosin 分析利用漏洞的具体过程。
A few transactions of the attacks: 0xc96b84cd834655290aa4bae7de80a3c117cc19d414f5bcf2fb85b8c5544300890x8eb73bd5c08318a4cfd233940c3a58744830cda999e59ecbc56f094618a91d690x6bada8e084f8d3b62311f0b6eda10f2690e7542dab75a0de436a640036bccf94
攻击者地址之一：0x1d371CF00038421d6e57CFc31EEff7A09d4B8760
被攻击合约之一：0xCba9b1Fd69626932c704DAc4CB58c29244A47FD3
被攻击的FTX热钱包地址：0xC098B2a3Aa256D2140208C3de6543aAEf5A94444
我们将以一个特定的攻击交易为例：（0x8eb73bd5c08318a4cfd233940c3a58744830cda999e59ecbc56f094618a91d69）
第一步，攻击者在链上部署了一个恶意合约地址（0xCba9b1Fd69626932c704DAc4CB58c29244A47FD3）
第二步，黑客利用自己的FTX热钱包地址向恶意合约地址（0xCba9...7FD3）转入少量资金，随后利用该合约批量创建子合约。
由于整个攻击过程中创建了很多合约，每次执行子合约时，子合约都会自毁，所以下图为例。
第三步，子合约的 fallback() 函数将向 $XEN 合约发起铸币请求。 claimRank() 函数传入铸造期限（>= 1 天），只需要支付调用的 gas 费用，无需任何其他相关费用。
claimMintRewardAndShare() 函数用于领取，只判断是否达到期限（本例中黑客设置为1天），然后可以无条件提现到任意地址。但是在这个调用过程中，交易发起方是FTX热钱包地址，所以整个调用过程的gas都是由FTX热钱包地址支付的，而$XEN铸币地址就是攻击者的地址。
以上三个步骤循环不断重复。每次撤回过期的代币并同时发起新的铸币请求。
这种攻击主要是利用了FTX没有对接收合约地址做任何限制，也没有对ETH的gas limit做任何限制，这使得黑客可以利用并铸造$XEN代币来获利。
截至发稿时，FTX 交易所共损失 81 个 ETH，黑客通过 DODO 和 Uniswap 等去中心化交易所用 $XEN 代币换取 ETH 转账。
Beosin 的资金变动和追踪图表
Binance partners up with Cristiano Ronaldo to launch "ForeverSkills," its fifth digital collectibles series, celebrating the football legend’s iconic talent and bringing fans closer to the football legend.
CatherineEthena Labs and WLFI partner to integrate sUSDe as collateral on WLFI’s Aave v3 platform, boosting liquidity and stablecoin adoption. Users gain rewards in sUSDe and WLF tokens, reflecting WLFI’s commitment to growth and asset integration.
KikyoEuropol and six nations dismantled a network laundering proceeds from major crimes, arresting nine and seizing evidence, €35,000 in cash, and €25 million in cryptocurrencies.
CatherineFartcoin, a Solana-based memecoin, briefly hit a $1 billion market cap before declining. Is this a sign of resilience or the start of a larger downturn?
KikyoAI is now a key driver of innovation, though its influence remains debated. The World Bank urges against rejecting AI, highlighting its transformative potential in developing nations and its ability to address global challenges despite critics' concerns about its risks.
CatherineCraig Wright, who controversially claims to be Bitcoin’s creator, received a one-year suspended sentence for contempt of court and was fined £145,000 in legal costs. The judge dismissed his claims against Bitcoin developers, calling him a liar who used "clumsy forgeries." Does this penalty truly address his actions, or is it too lenient?
CatherineIlya Lichtenstein claimed sole responsibility for the 2016 Bitfinex hack, denying Netflix’s allegations, and urged others not to blame his wife, who faces money laundering charges. Selfless defense or strategic narrative control?
KikyoSince 2021, Crypto.com and Formula 1 have cultivated a partnership focused on mutual growth. The renewed agreement secures Crypto.com's presence at major F1 events for the next five years. How far can this momentum drive both brands forward?
CatherineLuigi Mangione, accused of murdering UnitedHealth CEO Brian Thompson, is now housed with other high-profile inmates like SBF and Diddy. Is this facility becoming a hub for the notorious?
CatherineSpaceCoin XYZ has launched its first satellite, initiating an ambitious plan to build an extraterrestrial decentralised infrastructure network with up to ten satellites by 2025.
Kikyo