ETHEROLL

DESCRIPTION OF EVENTS

"Etheroll is an Ethereum smart contract for placing bets on our provably-fair dice game using Ether with no deposits or sign-ups. Each dice roll is provably random and cryptographically secure thanks to the nature of the Ethereum blockchain." The "Ethereum dice game is provably-fair, has a low 1% house edge and no sign-ups or deposits."

"Contract [was first placed] in lock-down mode." "After noticing some highly suspicious activity during game play [the team] put the contract into lock-down mode. This means the contract is currently not accepting any more bets, and all player payouts are frozen." "Any pending games [were] resolved and/or refunded."

"THE ATTACK: The attacker is monitoring honest players txs, oracle's txs and the chain. An honest player submits a bet, a request to the oracle for a random number (x), along with a betid occurs instantly on and off-chain. The betid is now ‘in-flight’ and destined to be returned to our contract in the future, in which case the address assigned to that betid receives payout on a win."

"Attacker is monitoring for chain forks, in which event the honest betid that was confirmed is not in the on-chain head anymore, the attacker pre-calculates that betid (trivial) then submits a tx which assigns that betid slot to be the same value as the one that is in-flight and now assigned to their address along with a new target x+1 (x being visible in-flight on the return), the in-flight callback completes and the payout is made."

"Attacker was also running contracts which were constantly submitting 90% bets to make sure there would be a bet to 'hijack' when/if a fork occurs. They essentially hijack their own bets which go missing during chain forks and 'reassign' the betid slot, whilst updating the target to be x+1."

"The attack was always going to be relatively slow as the method the attacker was using has constraints in that they needed to wait for a chain fork to occur in order to reassign the lost on-chain betid to their own address, which only happens every so often, which is probably why they decided to maximise their return when they finally did detect a chain fork and had set their target to be x+1. Essentially, they got greedy."

"Game contract [was subsequently] updated and deployed to production after security hardening. Additional data added to the oracle query id is verified in the callback (which is also included in the TLSNotary proof) that makes it impossible for an attacker to swoop in on forked query ids and change the forked player target and/or bet value."

Etheroll is an online gambling site, which enables users to interact with a smart contract for "provably fair" gambling.

The contract, however, had an exploit, that allowed some players to get an advantage and win repeatedly.

The contract was shut down before significant loss, and subsequently fixed.

HOW COULD THIS HAVE BEEN PREVENTED?

No user funds were lost in this case.

While not directly related to exchanges, this helps to demonstrate the limitations of smart contracts when it comes to having certainty of security.

The best storage of funds is in simpler multi-sig setups with trusted entities holding the keys.

Check Our Framework For Safe Secure Exchange Platforms

List of Ethereum Smart Contracts Post-Mortems - Security - OpenZeppelin Community (Jun 23)
Contract is currently in lock-down mode. All funds are safu. : etheroll (Jun 22)
https://www.etheroll.com/#/about (Jul 29)
Etheroll - Crunchbase Company Profile & Funding (Jul 29)
Online EVM Bytecode Decompiler (Jul 29)
Etheroll | 0xf478c8bc5448236d52067c96f8f4c8376e62fa8f (Jul 29)

More case studies

Hegic Exchange
Funds Locked

KeepKey Scam Chrome
Application Theft