-
How was the bug discovered?
PeckShield developed a script which track and send an alerts if an unreasonable amount of erc20 token is being transfered. They discovered this bug because a huge amount of Bec token have been transfered and their script have been trigger -
What is this vulnerability called?
They called this vulnerability batchOverflow because the exploit is related to an interger overflow . -
Which function is vulnerable?
The batchTransfer function is vulnerable in their contract -
Why was the vulnerability present in several ERC20 tokens?
Because a lot of people are copying and pasting the code of others -
Why is “code is law” mentality problematic when it comes to fixing bugs?
You can’t modify a basic contract already deployed , if you want to fix your bug you will have to deploy a new contract. -
How did exchanges react to this vulnerability?
They suspended the trading activity on this token, to protect their fund.
1 By automated system who scans and analyzes Ethereum-based (ERC-20) token transfers.
2 We call this particular vulnerability batchOverflow.
3 BatchTransfer.
4 ERC20 tokens commonly use boilerplate code.
5 Because in Etheruem blockchain you can’t edit smart contract after you put it in chain.
6 Uncoordinatedly.
1. How was the bug discovered?
By a self-developed automated system to scan and analyze Ethereum-based (ERC-20) token transfers
2. What is this vulnerability called?
batchOverflow
3. Which function is vulnerable?
batchTransfer
4. Why was the vulnerability present in several ERC20 tokens?
They were all based on the same code
5. Why is “code is law” mentality problematic when it comes to fixing bugs?
Because there is no traditional well-known security response mechanism in place to remedy these vulnerable contracts!
6. How did exchanges react to this vulnerability?
OKEx made an announcement to suspend the withdrawal and trading of BeautyChain ( BEC ). However, other exchanges also needed to be coordinated, there status is unknown.
People created a system to scan token transfers and found a transaction of an extremely high amount of BEC tokens.
batchOverflow
batchTransfer()
Wasn’t mentioned in the article, but I guess, people forget about the option that numbers can be overflowed/dont know it/or copy pasted exploitable code
Since we have to deal with a blockchain, and what is on a block, stays on the block, the code we have to produce needs to be 100% correct and should be created, that it wont need any updates. But when a bug appears this thinking is problematic since there be no way to remedy the vulnerable contracts in a traditional wellknown security response mechanism
Exchanges need to coordinate themself to not allow batchOverflow affected token to be traded
- How was the bug discovered?
By automated system designed to scan and analyze ERC-20 token transfers. - What is this vulnerability called?
BatchOverflow - Which function is vulnerable?**
batchTransfer() - Why was the vulnerability present in several ERC20 tokens?*
They all used the same code, that is part of the standard ERC20 contract - Why is “code is law” mentality problematic when it comes to fixing bugs?*
Once the contracts are deployed, they are immutable and there is no traditional security
response mechanism in place. - How did exchanges react to this vulnerability?**
Uncoordinatedly
1 - PeckShield had a monitoring system looking for extremely large amounts of tokens. In this case a particularly large amount of BEC tokens have been transferred, triggering an alarm on their side.
2 - batchOverflow
3 - batchTransfer
4 - Other ERC20 re-used the same vulnerable function
5 - Once it is deployed to the chain, it may be impossible to fix bugs, if no protection mechanisms are implemented.
6 - Some have suspended withdrawals, but not all. They should have all paused it…which is difficult to coordinate.
1. How was the bug discovered?
[spoiler]An automated system that scans ERC-20 tokens raised an alarm because of the gigantic size being transferred.[/spoiler]
2. What is this vulnerability called?
[spoiler]The vulnerability is called batchOverflow.[/spoiler]
3. Which function is vulnerable?
[spoiler]The batchTransfer function holds this vulnerability.[/spoiler]
4. Why was the vulnerability present in several ERC20 tokens?
[spoiler]In order to keep the ERC-20 standard, many developers reuse the same code.[/spoiler]
5. Why is “code is law” mentality problematic when it comes to fixing bugs?
[spoiler]The"code is law" mentality proves problematic because it’s difficult to fix code that’s meant to be immutable (and law, as it were).[/spoiler]
6. How did exchanges react to this vulnerability?
[spoiler]The article only cites that OKEx suspended the withdrawal and trading of BEC. I found out that Changelly, during that time, suspended their platform’s withdrawal and trading of all ERC-20 tokens.[/spoiler]
1.By the security team monitoring system
2. BatchOverflow
3.BatchTransfer
4. People fork the project code and modify only a bit of it.
5. Immutability
6. Drop the coins from exchanges
1. How was the bug discovered?
It was discovered by the software developed by PeckShield Inc. The software sent out an alert when it detected a suspicious transaction.
2. What is this vulnerability called?
The vulnerability is called batchOverflow.
3. Which function is vulnerable?
The vulnerability is within the function batchTransfer()
4. Why was the vulnerability present in several ERC20 tokens?
The simple fact that multiple ERC20 tokens used the vulnerable function in their contracts.
5. Why is “code is law” mentality problematic when it comes to fixing bugs?
with the touted “code-is-law” principle in Ethereum blockchain, there is no traditional well-known security response mechanism in place to remedy these vulnerable contracts! It’s up to each individual team’s responsibility to correct the issue, and If the team is not responding with any fix to the issue it’s not possible for a third -party to do anything more then inform the community.
6. How did exchanges react to this vulnerability?
OKEx was the first to make an announcement to suspend the withdrawal and trading of BeautyChain ( BEC ), the initial batchOverflow-affected token.
1. How was the bug discovered?
Essentially a “whale altert” notifying of a transfer of a ridiculously large amount of BEC. This caused them to dig deeper into what was going on with the smart contract.
2. What is this vulnerability called?
batchOverflow
3. Which function is vulnerable?
batchTransfer()
4. Why was the vulnerability present in several ERC20 tokens?
Because they share the same base code implementation of the batchTransfer method (copy paste fail).
5. Why is “code is law” mentality problematic when it comes to fixing bugs?
Just because the code is 100% guaranteed to execute does not mean it is correct. The immutability of deployed code makes it harder to correct bugs unless the code was designed to support updating the contract. Otherwise the same property that hardens smart contracts against modifications by attackers also prevents developers from fixing bugs!
6. How did exchanges react to this vulnerability?
By halting all trading and withdraws of BEC tokens.
1. How was the bug discovered?
automated system scans ERC20 tokens for large amounts in transactions
2. What is this vulnerability called?
batchOverflow
3. Which function is vulnerable?
batchTransfer
4. Why was the vulnerability present in several ERC20 tokens?
code copy paste … new ERC20 tokens reuse existing code from other
5. Why is “code is law” mentality problematic when it comes to fixing bugs?
A smartcontract cannot be upgraded easily
6. How did exchanges react to this vulnerability?
Halting trading for an affected token (OKex), others not.
-
How was the bug discovered?
A security team got an alert about two extremely large transactions -
What is this vulnerability called?
It`s called batch overflow and can make numbers reset if the space is used up and the numbers are pushed to overflow and restart at 0. -
Which function is vulnerable?
The batchTransfer function was were the vulnerability was in the value variable that could carry 256 bits integers. -
Why was the vulnerability present in several ERC20 tokens?
Because a lot of the erc20 tokens are just copied code from other projects with the same error. -
Why is “code is law” mentality problematic when it comes to fixing bugs?
Because if the code is law, then the code won`t be fixed and the bug is still around because of immutibility. -
How did exchanges react to this vulnerability?
They suspended withdrawal and trading for the beauty token. But they need to coordinate and stop this between exchanges. There are still vulnerable coins around. This can be a problem with DEX.
- Alert by an automated system to scan and analyze Ethereum-based (ERC-20) tokens. Alarm raised because of large amount of BEC tokens transfered.
- batchOverflow
- batchTransfer()
- The particular flavor of ERC-20 token was used for other chains as well. It was assumed to be trusted and proven.
- With the “code-is-law” principle, there is no security response mechanism in place to remedy these vulnerable contracts!
- More than 8 hours after the first transaction OKEx made an announcement to suspend the withdrawal and trading of BeautyChain. Other exchanges didnt react as “fast”
- How was the bug discovered?
- In independent security team noticed an anomaly using their automated transaction scanning system, where an extremely (and unusual) large amount of a token on the ethereum network was transferred.
- What is this vulnerability called?
- batchOverflow
- Which function is vulnerable?
- batchOverflow is essentially a classic integer overflow issue, that can occur in the function batchTransfer where the amount of the local variable is calculated as the product of cnt and _value.
- Why was the vulnerability present in several ERC20 tokens?
- Probably because they copy-pasted functions from eachother or inherited this function from each other. It doesn’t say in the article specifically why.
- Why is “code is law” mentality problematic when it comes to fixing bugs?
- The code should be immutable otherwise how can you trust a smart contract. Meaning that if there is an error, it is hard to fix it.
- How did exchanges react to this vulnerability?
- Exchanges can only decide to suspend trading of the particular token on their platform. Some did.
Thanks, for the heart… I was waiting for someone to give me mine…
And you came to the rescue…
I appreciate you noticing…
- The bug was discovered by an automated system that scan and analyze Ethereum-based (ERC-20) token transfers which is developed by PeckShield Inc
- Vulnerability is called “batchOverflow”
- It is in function “batchTransfer”
- Because of the use of third party ERC20 token library
- Because there is no traditional well-known security response mechanism in place to remedy these vulnerable contracts
- OKEx made an announcement to suspend the withdrawal and trading of BeautyChain (BEC), a batchOverflow-affected token
- By automated system to scan and analyze Ethereum-based token transfers
- batchOverflow bug
- batchTransfer
- Becose people re-use the same code
- Once deployed, changes on the contract are very difficult to implement
- OKEx suspended trading, while other were too slow to react
-
How was the bug discovered?
Patrolling system created by Peck Shield to detect extraordinary amount of transaction of tokens in exhcnage. -
What is this vulnerability called?
Batch Overflow Bug -
Which function is vulnerable?
Functioon ButchTransfer -
Why was the vulnerability present in several ERC20 tokens?
Because all the tokes are compliant to ERC20 where same functions might be used -
Why is “code is law” mentality problematic when it comes to fixing bugs?
It makes that developers think that code is perfect always in fact sometime not. -
How did exchanges react to this vulnerability?
Stopped trading the tokens with the bug.
-
How was the bug discovered?
By an alert set on large amount transactions on the ERC20 token by an automated system scanner of a third-party independent security team. -
What is this vulnerability called?
a batch overflow -
Which function is vulnerable?
batchTransfer -
Why was the vulnerability present in several ERC20 tokens?
The ERC20 token is a standard and by being open-source developers reused the code of the ERC20 token of the BeautyChain. -
Why is “code is law” mentality problematic when it comes to fixing bugs?
Having an error in the code is like having an error in a traditional law. It creates a loop-hole that requires an in-depth discussion before making the correction and releasing the fix. This takes time and in the meanwhile the loop-hole can be exploited. -
How did exchanges react to this vulnerability?
The trading platforms trading the problematic token decided to suspend trading it.
-
The bug was discovered when a overly large transaction was sent.
-
The vulnerability was called: Bach Overflow.
-
The function was called: BachTransfer.
-
Problably other contracts dont see it as a broblem.
-
The problem is sence they are a third party thay do not have acces to these contracts.
-
The price of the criptocurinsy can rize if the owner sells his coins so he can make a profit.