Hacker News
points by yobananaboy 3 days ago | 0 comments
Not just that! The EIP-7702 delegation to make the wallet into a smart contract bypassed all of the controls that they had in place on the signer. It's wild that they didn't have a system in place to stop it from signing that transaction type.
[–] tennysont 3 days ago
From my rough understanding, this seems like the main exploit. It seems like the machine with access to the wallet key was presented with a crazy EIP-7702 transaction and signed it (which effectively owned its wallet in a single transaction)[1]. Without knowing their security model, it seems like biggest trust boundary should be between that signing machine and everything else.

[1] The fact that the needed to sign 50 of these transactions to solve a race condition seems like an implementation detail

[–] yobananaboy 1 day ago
They had to sign 50 of them because they had to compete timing the transaction with the normal transactions. Transactions have to be in nonce order for the wallet, and if two transactions with the same nonce are submitted to a block, it is up to the miner / validator to determine which one to put in. So if you spray 50, you can almost guarantee that the transaction you want will get in.
[–] stogot 3 days ago
Is quorum signing not a thing in crypto?
[–] cowlevel 3 days ago
In Ethereum it would be implemented by linking your account to smart contract code, then throwing away your private key so you can only make transactions through the smart contract. The approval of linking to smart contract code is exactly what they signed here - only it wasn't a multisig smart contract, it was something malicious.
[–] tennysont 3 days ago
It is---though I don't see the connection