Mask
Doppler Doppler 2296 55062 139 25695 29 228751 35367 55 25194
112150 34685 140 15349 364 635588
174468 738539 8958
Crosshair Crosshair

Phantom Functions and the Billion-Dollar No-Op

We disclosed a major vulnerability to the Multichain project (formerly "AnySwap"). The threat was one of the largest, if not the largest, in crypto history, and the attack vector is novel. It turns out that some ERC20 tokens, most notably WETH, that has a permissive fallback function will allow arbitrary function calls to succeed. The reasons for this are complex, but have to do with low-level EVM semantics, the Ethereum ABI standard, and the way the Solidity compiler works. The article describes how an attacker could steal > $1B worth of WETH from Multichain and Fantom, after responsibly disclosing this issue to the Multichain team.

Read more
(in Chinese)