Hyperinflation Vulnerability - Reading Assignment

[bigbill]

1. **How was the bug discovered?
   An internal security system raised an alarm which is related to an unusual BEC token transaction. Someone transferred an extremely large amount of BEC token.
2. **What is this vulnerability called?
   batchOverflow
3. Which function is vulnerable?
   batchTransfer
4. **Why was the vulnerability present in several ERC20 tokens?
   Because probably they inherit from some base contract or use the same source (library)
5. **Why is “code is law” mentality problematic when it comes to fixing bugs?
   Because deployed code is immutable, it can’t be changed once deployed.
6. **How did exchanges react to this vulnerability?
   They suspended withdrawal and trading of these coins

[RoryPhilBTC]

1. How was the bug discovered?
By PeckShield’s automated system that scans and analyses Ethereum-based (ERC-20) token transfers for suspicious transactions.

2. What is this vulnerability called?
batchOverflow

3. Which function is vulnerable?
batchTransfer

4. Why was the vulnerability present in several ERC20 tokens?
A lot of code gets reused in programming ERC20 tokens so if they all used a library like OpenZeppelin and that was prone to batchOverflow then they would all be vulnerable.

5. Why is “code is law” mentality problematic when it comes to fixing bugs?
Because if there is problematic code like in this example the smart contract will have to be redeployed with different code. There is also no traditional well-known security response mechanism in place to remedy these vulnerable contracts.

6. How did exchanges react to this vulnerability?
They suspended withdrawals and trading on the token.

[vinicanhaci]

1. How was the bug discovered?
2. What is this vulnerability called?
3. Which function is vulnerable?
4. Why was the vulnerability present in several ERC20 tokens?
5. Why is “code is law” mentality problematic when it comes to fixing bugs?
6. How did exchanges react to this vulnerability?

1. A security team got an alert about two extremely large transactions

2. The vulnerability is called BatchOverflow.

3. batchTransfer

4. Cause they use the same base code for ERC20 tokens (standard)

5. The “code is law” mentality prevents developers from making changes to the smart contract after deployment. It can become problematic if the smart contract contains vulnerabilities because any data stored on the blockchain remains immutable.

6. Other exchanges also need to be coordinated and there still exist other tradable tokens vulnerable to batchOverflow (BEC was suspended the trading).

[benr]

1. How was the bug discovered?
an automated system of peckshield raised an alarm when a unusual big amount of bec token was transfered
2. What is this vulnerability called?
batchOverflow
3. Which function is vulnerable?
batchTransfer
4. Why was the vulnerability present in several ERC20 tokens?
The article doesn’t mention it. As erc20 contracts a standardized probably some projects copied it without looking into it.
5. Why is “code is law” mentality problematic when it comes to fixing bugs?
as on the blockchain deployed code is or should be immutable, if it’s upgradeable there are other ways to exploit it.
6. How did exchanges react to this vulnerability?
some suspended trading and withdraw/deposit

[Vitaliy]

1. By an automated system developed by the security company PeckShield for analyzing ERC-20 token transactions. This system also sends out automatic alerts if anything suspicious occurs, in this case, an extraordinarily huge amount of BEC has been transferred.
2. batchOverflow
3. batchTransfer()
4. Because programmers copied each others code replicating the BatchOverFlow vulnerability.
5. The smart contract is immutable and lasting forever, and its code act as the fundament of trustless and voluntary transactions. The “code-is-law”. Thus, even bugs are part of the contract in this mentality and individuals are responsible for themselves and should consider these bugs before using the contract. Providing an option for updating implies that one must trust at least the developer team and that they wouldn’t just implement another exploit serving themselves or altering the code in another unwanted way.
6. OKEx made an announcement to suspend the withdrawal and trading of BeautyChain ( BEC ), a batchOverflow-affected token, but other exchanges were too slow to react.

[mjwatson10]

1. How was the bug discovered?
   An alarm was raised when an unreasonably large transaction occurred.

2. What is this vulnerability called?
   batchOverflow

3. Which function is vulnerable?
   batchTransfer

4. Why was the vulnerability present in several ERC20 tokens?
   ERC20 token standard is commonly used code

5. Why is “code is law” mentality problematic when it comes to fixing bugs?
   Because smart contracts are immutable and if there is a bug change the code becomes a big challenge

6. How did exchanges react to this vulnerability?
   One exchange suspended trading while others did not react soon enough

[SmartboyML_AI]

Good day folks, I had a quick scan of the 146 answers to the “Hyperinflation Vulnerability” question, and noticed that on only 2 people had “code-snippets” in their answer. Since i’m relatively new to this academy, isn’t providing “code-snippets” part of our standard question answering method?

[Samuel1]

1. The bug was discovered by a system alarm, UTC, indicating a large volume of tokens in a transaction and two transactions in the same chain to two different addresses with same large volume of tokens.
   2.The vulnerability is called batchOverflow, a classic integer overflow issue.
2. The vulnerability is found in the batchAddress function. The overflow amounts to a zero value (999+1 =>000) and the require statements(line 258-259) can pass and make the .sub(amount) negated(line 261).
   
3. It was found in a multiple ERC20 tokens because ERC20 is a standard and there are many similar versions of ERC20 tokens on the market due to “copy-pasting” code and making minute changes. Hence Uniswap, Pancake swap, Sushi, and Burger Swap.
4. There is no traditional protocol or response to bugs.
5. The specific BeautyChain was suspended from OKEx (had an independent third-party security teams) but other exchanges, vulnerable to batchOverflow hacks, do not have independent security teams and thus are more susceptible to attack. The vulnerablility can cause price manipulation to certain cryptocurrencies.

[ivanovp]

1. How was the bug discovered? - Independent security team found it with their tool for monitoring strange transactions.
2. What is this vulnerability called? - It was called batchOverflow
3. Which function is vulnerable? - batchTransfer is vulnerable
4. Why was the vulnerability present in several ERC20 tokens? - Because they just copypasted code from each other
5. Why is “code is law” mentality problematic when it comes to fixing bugs? - Because such a bug can cost a large damage to the whole crypto ecosystem. - Code is law prevent ability to fix bugs easily
6. How did exchanges react to this vulnerability? - They suspended BEC deposits

[MarkSuscens]

1. How was the bug discovered?
Pecksheild (a blockchain security company) developed and ran automated system to look for suspicious transactions of the Ethereum blockchain (e.g. very large transactions). On 22/04/2018 the system flagged up a ridiculously large transaction for BEC (Beauty Chain) tokens, where 0x8000,0000,0000,0000,0000,0000,0000,0000,0000,0000,0000,0000,0000,0000,0000,0000 BEC tokens were transferred! Subsequent examination of the smart contract code revealed an integer overflow vulnerability in the code.

2. What is this vulnerability called?
This vulnerability is called ‘Batch Overflow’.

3. Which function is vulnerable?
BatchTransfer is the vulnerable function, where a very large _value can cause amount to overflow and become equal to zero:

This was exploited by having two _receivers (attacker controlled addresses) passed into batchTransfer() that caused amount to overflow and be zeroed. This means that the ‘require’ checks (lines 258–259) pass and nothing was subtracted from the attacker’s balance (line 261). Finally, the balance of the two receivers are increased by the extremely large _value (at no cost to the attacker). Another consequence is that the overall token supply is greatly inflated (with these new tokens being ‘illicitly’ created).

4. Why was the vulnerability present in several ERC20 tokens?
Because this vulnerable contract code has been reused by a number of projects (either copy & paste reuse or by inheriting from this vulnerable contract code to use it as the base contract for their own token contract)

5. Why is “code is law” mentality problematic when it comes to fixing bugs?
With the ‘code is law’ principle enshrined with many blockchains, once released smart contracts are immutable. It is by default not possible to change the contract code in order to fix such vulnerabilities (or other bugs that cause or allow undesirable effects). Therefore it is very difficult to find an effective security response to such attacks.

6. How did exchanges react to this vulnerability?
OKEx (a centralised exchange) removed the vulnerable BEC token from their exchange, stopping trading in the token (and thereby prevent the attacker - or any other BEC token holder - from cashing out). However, today as Decentralised exchanges become ever more prevalent, centralised exchanges de-listing such ‘inflated tokens’ is far less effective if the token remains tradeable on DEXs.

[paddyc1]

1. The bug was discovered by PeckShield’s system to alert any suspicious token transfer amounts.
2. It was called batch overflow.
3. Batch transfer functions are vulnerable.
4. It was present in several ERC20 tokens that used batch transfer to calculate the amount by multiplying two user input numbers.
5. It is problematic to see the code as immutable because the developers need to react to vulnerabilities by fixing them and upgrading.
6. Exchanges suspended trading of vulnerable tokens.

[maxs]

1. How was the bug discovered?
With an alarm that detects suspicious transactions, for example with very big amount of tokens.
2. What is this vulnerability called?
batchOverflow
3. Which function is vulnerable?
batchFunction
4. Why was the vulnerability present in several ERC20 tokens?
Vulnerable code was reused
5. Why is “code is law” mentality problematic when it comes to fixing bugs?
Because you can’t fix the bugs in immutable contracts.
6. How did exchanges react to this vulnerability?
OKEx suspended trading of the affected token BEC, however other exchanges did not react.

[mervxxgotti]

1. How was the bug discovered? - abnormally large token transfer
2. What is this vulnerability called? - batchOverflow
3. Which function is vulnerable? - batchTransfer()
4. Why was the vulnerability present in several ERC20 tokens? - these contracts inherited this same vulnerability
5. Why is “code is law” mentality problematic when it comes to fixing bugs? - no well know response mechanism made yet, and blockchains are supposed to be immutable
6. How did exchanges react to this vulnerability? - suspending withdrawal

[Mickey_McClimon]

1: The bug was discovered by the security team’s transaction monitoring system.

2: batchOverflow

3: batchTransfer

4: Because there were so many tokens created during that time others would copy code, therefore, leaving the vulnerability in the source code from the start.

5: Due to the nature of immutable Smart Contracts you cannot go back and just change the code.

6: Most large exchanges did not coordinate with each other and this caused a problem for several exchanges. In one such exchange OKE did suspend trading of the BeautyChain token due to the problem.

[Ishoboy]

1. How was the bug discovered?

• It was discovered because of unusual large amount of transaction for this instance a large token transfer that had happened.

2. What is this vulnerability called?

• batchOverflow

3. Which function is vulnerable?

• batchTransfer()

4. Why was the vulnerability present in several ERC20 tokens?

• Because developers from different projects just copy and paste each others code as long as it has same functionalities like in a fungible token standard like erc20.
  That’s causes the batchOverflow vulnerability being pass to another erc20 tokens.

5. Why is “code is law” mentality problematic when it comes to fixing bugs?

• Because there is no traditional well know security response mechanism in place to remedy these vulnerable contracts.

6. How did exchanges react to this vulnerability?

• OKEx suspended the withdrawal and trading of BeautyChain, but the other exchanges needs to coordinate with each other specially when their platform does have tokens that have batchOverflow vulnerability.

[Obi]

1.)
Discovert by PeckShield A Blockchain Security Company (https://peckshield.com)
“In particular, on 4/22/2018, 03:28:52 a.m. UTC, our system raised an alarm which is related to an unusual BEC token transaction.”

2.)
batchOverflow

3.)
function batchTransfer
The both require statements are ineffective as they are undermined by the batchOverflow bug.

4.)
ERC20 token standard + copy / paste mentality

5.)
There is no traditional well-known security response mechanism in place to remedy these vulnerable contracts!

6.)
They suspended the withdrawal and trading of BeautyChain.

[walter_w]

1. defensive programming to identify transaction that seem impossible
2. batchOverflow
3. any that doesn’t fail on over/underflows
4. base contracts or sample code that everyone used
5. doesn’t allow for fixing of bugs
6. by suspending trading of the tokens

[REGO350]

1. They had an automated system to scan and analyze ERC-20 token transfers. Their system will automatically send out alerts if any suspicious transactions.

2. They called this vulnerability batchOverflow.

3. batchTransfer function is vulnerable.

4. The vulnerability was present in several ERC20 tokens because they used the same language, Solidity. Also some of them used the exact same code from BEC token.

5. “Code is law” is mentality problematic because even if you fix the bug, you cannot reverse what happened before.

6. Some exchanges suspended withdraw.

[REGO350]

The number he used in the next video is:
0x8000000000000000000000000000000000000000000000000000000000000000

2^256 / 2 in hexadecimal.

[Su.kal.Crypto]

1.The bug was discovered by a Group/ Solo Hacker and later notified to Industry by a Blockchain security audit agency using on chain analytics software.
2. batchOverflow Vulnerability
3. BatchTransfer
4. I guess, the reason is "ERC20 token is a standard, so it felt safe to take someone’s else implementation (for example from OpenZeppelin or another similar source, or some ERC20 contract published by another well known and respected company) and apply it to your token.
5. Bcoz of Blockchain Immutability and Lack of Upgradeable proxy contracts.
6. Shut down the transfers of these ERC 20 tokens.