Get trading recommendations and read the analysis on Hacked.com for only $ 39 a month
As CCN has recently reported, the Ethereum ecosystem has encountered another black swan event this week, as a bug has been activated the multi-signature wallet published by Parity Technologies. The bug resulted in permanent loss of access to millions of dollars for users, with the Github "devops199" user having revealed that he had inadvertently exploited a bug in the library's Parity Wallet. Cappasity recently pointed out that something does not add up, and that the bug could have been deliberately exploited.
The user revealed what had happened with the words "I accidentally killed him" and a link to a smart contract address on Etherscan. Devops199 apparently turned the library contract into a regular multi-sig wallet and became the owner. He then tried to delete the code that belonged to him, but since the wallet contained the library contract code – on which all the Parity multi-sig portfolios are supported – the deletion froze millions of funds stored in multi-sig portfolios of parity.
Although developers are still studying the problem, reports suggest that the only way to recover frozen funds is through the fork of the Ethereum platform. If the platform is equipped with a rigid fork and some users refuse to upgrade to the new software, a chain division may occur. Last year, a hard fork that recovered $ 50 million from DAO hacking resulted in the creation of Ethereum Classic.
This is not the first time that a bug in Parity's multi-sig portfolio code is causing a loss of funds. Earlier this year, an attacker exploited it to steal more than $ 30 million of ether, and was only halted when hackers drained the affected accounts and then returned the funds. users.
Was it an accident?
Cappasity, a company in the middle of its initial coin offering (ICO) affected by the incident, contacted NCC to inform us of the results of its internal investigation. The company's investigation found that the actions of devops199 were not accidental, but "deliberate and fraudulent".
Through an average blog post, the company informed its users of their current ICO ARToken and the results of their investigation. At the beginning of the message, the company clearly indicates that its platform is secure, as well as funds that have not been affected by the situation. In addition, he clarifies the release of his ARToken has not been affected, and that the team is confident that Parity Technologies and the Ethereum Foundation will find a way to correct the situation.
Then he explains the reasoning behind the results of his investigation. By blog post, on Nov. 6, the user of "devops199" attempted to "call execute (_to address, uint256 _value, _data bytes) from the intelligent contract of ARToken . "
Later that day, he called the execution of Polkadot's smart contract, which now has more than $ 90 million in frozen funds. Then, the functions "changeOwner (address_from, address_to) and kill (address_to)" were called. According to the team, after following all the transactions, the logical conclusion is that they were deliberate.
In Cappasity, if the situation is not resolved quickly, law enforcement agencies should be contacted. NCC has contacted Cappasity founder and CEO, Kosta Popov, to learn more about the survey, and will update the piece as soon as more information becomes available.