Fun

Over $1 Billion Ethereum-Based Tokens Vulnerable to ‘Fake Deposit Exploit’

News Feed - 2020-08-28 09:08:25

Over $1 Billion Ethereum-Based Tokens Vulnerable to "Fake Deposit Exploit"


A number of university researchers published a study that demystifies the “fake deposit vulnerability” in Ethereum-based smart contracts. The findings show that over 7,000 tokens worth more than $1 billion built on top of Ethereum are vulnerable to two types of attacks that exploit smart contracts.


Researchers from the University of Queensland, Beijing University of Posts and Telecommunications, Zhejiang University, and Peking University have published a paper that describes a vulnerability held by over 7,000 Ethereum-based tokens.


Essentially, the tokens created have verification methods that are subpar to ERC20 contracts released after 2017. The vulnerability allows the token’s codebase to be manipulated and hackers can easily steal millions of dollars by executing the “fake deposit vulnerability.”


What is worse is that there are more than 25 million smart contracts built using the Ethereum network and the researchers say only “0.36% of them have released their source code according to our dataset.”


Moreover, the paper discusses that the tokens are vulnerable on both decentralized exchanges (dex) and centralized exchanges (cex) because they allow these coins to be swapped “without comprehensive verification.”


The team of researchers leveraged a tool called “Deposafe,” which allows the testing of a large number of ETH-based smart contracts.


“In this work, we have systematically characterized the fake deposit vulnerability in Ethereum. Deposafe, an automated tool is proposed to perform the detection and verification of the vulnerability,” the paper states.


“We demonstrate the efficiency of Deposafe with experiments on a large number of smart contracts. Our observations reveal the prevalence of fake deposit vulnerability in the ERC20 smart contracts,” the university’s scholars wrote.


The investigators found that 7,735 tokens can be influenced by the fake deposit vulnerability using a “Type-I attack.” While “7,716 tokens that are vulnerable to “Type-II attack” with a market cap of over $1 billion.


“The number of holders and transactions would be 695K and 4.6 million respectively,” the paper stresses.


The paper also identifies the dexes that have high active trading on a daily basis and could suffer from the fake deposit attack. Dex platforms listed in the researcher’s paper include Ether Delta, DDEX, and IDEX.


Centralized exchanges (cex) that fall victim to the fake deposit attack could lose substantial amounts of funds.


“If a cex allows these tokens to be traded without comprehensive verification, the financial loss will be tremendous,” the paper highlights.


The authors of the report say that the efforts they have provided can “contribute to bring developer awareness” and hopefully “promote best operational practices across blockchains.”


The listed cex platforms mentioned in the researcher’s study include companies like Kraken, Binance, and Coinbase. ERC20s who are allegedly vulnerable to the fake deposit exploit include BRC token, PWR token, BAT, HPT token, Cloudbric, RPL token, Moviecredits, and more.


What do you think about the fake deposit attack? Let us know what you think about this subject in the comments section below.Banks in Mexico Pose Greater Money Laundering Risk Than Crypto Firms, Says ReportNEWS | 2 hours ago"Bitcoin Will Never Ditch You" Ad Dominates Front Page of Major Hong Kong NewspaperNEWS | 16 hours agoTags in this story1 billion, CEX, crypto, Deposafe, DEX, ERC20, ERC20 Tokens, ETH tokens, ETH-based smart contracts, Ethereum, Fake Deposit, Fake Deposit Exploit, Smart Contracts, subpar verification, Type-I attack, Type-II attack, verification methods, Vulnerability


Image Credits: Shutterstock, Pixabay, Wiki CommonsSpot-markets for Bitcoin, Bitcoin Cash, Ripple, Litecoin and more. Start your trading here.Disclaimer: This article is for informational purposes only. It is not a direct offer or solicitation of an offer to buy or sell, or a recommendation or endorsement of any products, services, or companies. Bitcoin.com does not provide investment, tax, legal, or accounting advice. Neither the company nor the author is responsible, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any content, goods or services mentioned in this article.Read disclaimerShow comments

News Feed

Jed McCaleb Sells $22 Million Worth of XRP, Ripple Cofounder’s Stash Could Run Dry by May
Jed McCaleb Sells $22 Million Worth of XRP, Ripple Cofounder"s Stash Could Run Dry by May During the last few weeks, the former Ripple executive Jed McCaleb has
Pricing Gold, Food, and Altcoins With the BTC Denominator: How to Measure an Asset’s Worth in Bitcoin
Pricing Gold, Food, and Altcoins With the BTC Denominator: How to Measure an Asset"s Worth in Bitcoin On February 21, bitcoin touched a lifetime price high at $5
Bitcoin traders ‘under pressure’ after deepest correction since 2022 erases profits
Nancy Lubale2 hours agoBitcoin traders ‘under pressure’ after deepest correction since 2022 erases profits83% of short-term Bitcoin traders saw losses after BTC price recorded its deepest drawdown since 2022.1378 Tot
Ciaran Lyons6 hours agoUK regulator advocates for asset managers to tokenize fundsThe United Kingdom"s financial regulator has endorsed a blueprint model designed to facilitate the tokenization of funds for asset managem
Aave protocol’s GHO stablecoin now live on Arbitrum
Vince Quill1 hour agoAave protocol’s GHO stablecoin now live on ArbitrumThe deployment of the GHO stablecoin on the Ethereum layer-2 network will leverage Chainlink"s CCIP interoperability protocol.410 Total views22 To
Arijit Sarkar40 minutes agoAustralia to impose capital gains tax on wrapped cryptocurrency tokensDelivering a major hit to Australian crypto investors, the ATO stated that wrapping or unwrapping tokens — irrespective o
Turner Wright17 hours agoUS Attorney’s Office announces criminal fraud charges against Alex MashinskyAuthorities said they had reached a “non-prosecution agreement” with Celsius, but former CEO Alex Mashinsky will
Bitcoin to Peak at $115,000 by August Next Year, Says Pantera Capital CEO
Bitcoin to Peak at $115,000 by August Next Year, Says Pantera Capital CEOPantera Capital chief executive officer Dan Morehead has predicted a 50% chance the price of bitcoin (BTC) w
Rakesh Upadhyay6 hours agoPrice analysis 11/3: BTC, ETH, BNB, XRP, SOL, ADA, DOGE, TON, LINK, MATICBitcoin price is losing its upward momentum, but data suggests traders are gearing up to buy any significant dips.2459 To
Who is ‘Mr. 100’? Mysterious Bitcoin whale becomes 14th-biggest BTC holder
Zoltan Vardai8 hours agoWho is ‘Mr. 100’? Mysterious Bitcoin whale becomes 14th-biggest BTC holderThe Bitcoin wallet has added 100 BTC tranches regularly since at least November 2022, when FTX collapsed.3833 Total vi
EURST Stablecoin – Reinvention of the European Economy
EURST Stablecoin – Reinvention of the European Economy Over the years, we have been introduced to a digital transformation, which has created and shaped commun
Ana Paula Pereira4 hours agoAave DAO opens voting on proposals to reduce CRV exposureAave tokenholders are voting on three proposals that could reshape the protocol’s exposure to the Curve DAO token.669 Total views34 T