Over $1 Billion Ethereum-Based Tokens Vulnerable to "Fake Deposit Exploit"
A number of university researchers published a study that demystifies the “fake deposit vulnerability” in Ethereum-based smart contracts. The findings show that over 7,000 tokens worth more than $1 billion built on top of Ethereum are vulnerable to two types of attacks that exploit smart contracts.
Researchers from the University of Queensland, Beijing University of Posts and Telecommunications, Zhejiang University, and Peking University have published a paper that describes a vulnerability held by over 7,000 Ethereum-based tokens.
Essentially, the tokens created have verification methods that are subpar to ERC20 contracts released after 2017. The vulnerability allows the token’s codebase to be manipulated and hackers can easily steal millions of dollars by executing the “fake deposit vulnerability.”
What is worse is that there are more than 25 million smart contracts built using the Ethereum network and the researchers say only “0.36% of them have released their source code according to our dataset.”
Moreover, the paper discusses that the tokens are vulnerable on both decentralized exchanges (dex) and centralized exchanges (cex) because they allow these coins to be swapped “without comprehensive verification.”
The team of researchers leveraged a tool called “Deposafe,” which allows the testing of a large number of ETH-based smart contracts.
“In this work, we have systematically characterized the fake deposit vulnerability in Ethereum. Deposafe, an automated tool is proposed to perform the detection and verification of the vulnerability,” the paper states.
“We demonstrate the efficiency of Deposafe with experiments on a large number of smart contracts. Our observations reveal the prevalence of fake deposit vulnerability in the ERC20 smart contracts,” the university’s scholars wrote.
The investigators found that 7,735 tokens can be influenced by the fake deposit vulnerability using a “Type-I attack.” While “7,716 tokens that are vulnerable to “Type-II attack” with a market cap of over $1 billion.
“The number of holders and transactions would be 695K and 4.6 million respectively,” the paper stresses.
The paper also identifies the dexes that have high active trading on a daily basis and could suffer from the fake deposit attack. Dex platforms listed in the researcher’s paper include Ether Delta, DDEX, and IDEX.
Centralized exchanges (cex) that fall victim to the fake deposit attack could lose substantial amounts of funds.
“If a cex allows these tokens to be traded without comprehensive verification, the financial loss will be tremendous,” the paper highlights.
The authors of the report say that the efforts they have provided can “contribute to bring developer awareness” and hopefully “promote best operational practices across blockchains.”
The listed cex platforms mentioned in the researcher’s study include companies like Kraken, Binance, and Coinbase. ERC20s who are allegedly vulnerable to the fake deposit exploit include BRC token, PWR token, BAT, HPT token, Cloudbric, RPL token, Moviecredits, and more.
What do you think about the fake deposit attack? Let us know what you think about this subject in the comments section below.Banks in Mexico Pose Greater Money Laundering Risk Than Crypto Firms, Says ReportNEWS | 2 hours ago"Bitcoin Will Never Ditch You" Ad Dominates Front Page of Major Hong Kong NewspaperNEWS | 16 hours agoTags in this story1 billion, CEX, crypto, Deposafe, DEX, ERC20, ERC20 Tokens, ETH tokens, ETH-based smart contracts, Ethereum, Fake Deposit, Fake Deposit Exploit, Smart Contracts, subpar verification, Type-I attack, Type-II attack, verification methods, Vulnerability
Image Credits: Shutterstock, Pixabay, Wiki CommonsSpot-markets for Bitcoin, Bitcoin Cash, Ripple, Litecoin and more. Start your trading here.Disclaimer: This article is for informational purposes only. It is not a direct offer or solicitation of an offer to buy or sell, or a recommendation or endorsement of any products, services, or companies. Bitcoin.com does not provide investment, tax, legal, or accounting advice. Neither the company nor the author is responsible, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any content, goods or services mentioned in this article.Read disclaimerShow comments