EOS EVM Contract Drain Vulnerability - Revision history

Azoundria: Another 30 minutes complete.

2023-06-14T22:17:50Z

Another 30 minutes complete.

Azoundria: Completed another 30 minutes.

2023-05-30T20:02:37Z

Completed another 30 minutes.

← Older revision		Revision as of 14:02, 30 May 2023
Line 1:		Line 1:
	{{~~Imported~~ Case Study~~\|source=https://www.quadrigainitiative.com/casestudy/eosevmcontractdrainvulnerability.php~~}}[[File:Eosio.jpg\|thumb\|EOS.io Logo]]A critical vulnerability was uncovered and resolved in the EOS EVM before it could be exploited. The vulnerability, if exploited, would have allowed draining all contracts storing EOS across the trustless bridge. According to the report, the vulnerability was never exploited.		{{Case Study Under Construction}}[[File:Eosio.jpg\|thumb\|EOS.io Logo]]A critical vulnerability was uncovered and resolved in the EOS EVM before it could be exploited. The vulnerability, if exploited, would have allowed draining all contracts storing EOS across the trustless bridge. According to the report, the vulnerability was never exploited.

	== About EOS Blockchain ==		== About EOS Blockchain ==
Line 16:		Line 16:
	* The EOS EVM Node and RPC (remote procedure call). This allows for the operation of EVM nodes and remote interaction with those nodes.		* The EOS EVM Node and RPC (remote procedure call). This allows for the operation of EVM nodes and remote interaction with those nodes.
	* The transaction wrapper, an Node.js application to service the eth_sendRawTransaction and eth_gasPrice functions.		* The transaction wrapper, an Node.js application to service the eth_sendRawTransaction and eth_gasPrice functions.
			A press release for EOS explains more about the EVM use case<ref name=":5">[https://eosnetwork.com/blog/major-updates-to-eos-evm-and-silkworm-based-v0-2-deployed-to-testnet/ Major Updates to EOS EVM and Silkworm-based v0.2 Testnet Deployed - EOS Network Foundation] (May 30, 2023)</ref>.<blockquote>Building applications on different blockchains can be challenging due to the competition for limited resources and end users. One major obstacle is the inflow of developers and availability of familiar and easy-to-use tooling. This can limit the speed at which an ecosystem can develop and the scale at which applications can be built.

			EOS EVM aims to address these challenges by enabling Ethereum-like transactions on the EOS Network through a smart contract-based Ethereum Virtual Machine (EVM), allowing developers to seamlessly build Ethereum-based applications on EOS to take advantage of its world class performance, reliability, and liquidity.

			With the introduction of EOS EVM, Ethereum-based projects can tap into the previously inaccessible audience and liquidity of EOS without needing to rewrite their code in C++. As a result, users will now get to enjoy enhanced user experiences on EOS without losing out on Ethereum’s battle-tested open source code, tooling, libraries, and SDKs.</blockquote><ref name=":6">[https://eosnetwork.com/blog/eos-evm-architecture-deep-dive/ EOS EVM Architecture Deep Dive - EOS Network Foundation] (May 30, 2023)</ref><ref name=":7">[https://hackmd.io/@EOSNF/S1w35qEGn EOS EVM v0.4.0 Release Notes - EOS Network Foundation] (May 30, 2023)</ref><ref name=":8">[https://cryptoslate.com/eos-community-delivers-ethereum-evm-support-to-revitalize-the-network/ EOS Community delivers Ethereum EVM support to revitalize the network - CryptoSlate] (May 30, 2023)</ref><ref>[https://docs.eosnetwork.com/ EOS EVM - EOS Network Docs Homepage] (May 30, 2023)</ref>

	=== Getting Blockchain Information ===		=== Getting Blockchain Information ===
Line 39:		Line 44:
	!Event		!Event
	!Description		!Description
			\|-
			\|April 21st, 2022 8:30:00 AM MDT
			\|CryptoSlate Article
			\|The EOS EVM is announced in a CryptoSlate article<ref name=":8" />, referencing an announcement that work on the Trust EVM was already completed.
			\|-
			\|January 18th, 2023 7:24:00 AM MST
			\|Yves La Rose Announcement
			\|Yves La Rose announces the EOS EVM on Twitter<ref>[https://twitter.com/BigBeardSamurai/status/1615716731476910082 BigBeardSamurai - "Not only is EOS EVM by far the most performant EVM (800+ swaps per second - 4x faster than Solana), but we have improved the token model." - Twitter] (May 30, 2023)</ref>.
			\|-
			\|January 20th, 2023 8:09:20 AM MST
			\|EOS Network Foundation Announcement
			\|The EOS Network foundation announces major changes to the EOS EVM system<ref name=":5" />.
			\|-
			\|March 24th, 2023 9:48:38 AM MDT
			\|EOS EVM Architecture Deep Dive
			\|The EOS Network Foundation publishes a deep dive into the EOS EVM architecture<ref name=":6" />.
			\|-
			\|April 12th, 2023 2:55:11 PM MDT
			\|EOS EVM 0.4.0 Release Notes Published
			\|The release notes for the EOS EVM 0.4.0 are published<ref name=":7" />.
	\|-		\|-
	\|May 11th, 2023 12:20:00 AM MDT		\|May 11th, 2023 12:20:00 AM MDT
Line 62:		Line 87:

	== Technical Details ==		== Technical Details ==
	~~According to~~ the release notes.<ref name="eosnetworkfoundationgithub-11035" /><blockquote>"The security vulnerability is related to the state objects tracking the reserved addresses of the trustless bridge and how they were not properly being undone in the case of an EVM execution context being reverted. If exploited, it could potentially allow an attacker to illegitimately drain all of the EOS stored by the EOS EVM Contract across the trustless bridge."		Some information is provided in the release notes<ref name="eosnetworkfoundationgithub-11035" />.<blockquote>"The security vulnerability is related to the state objects tracking the reserved addresses of the trustless bridge and how they were not properly being undone in the case of an EVM execution context being reverted. If exploited, it could potentially allow an attacker to illegitimately drain all of the EOS stored by the EOS EVM Contract across the trustless bridge."</blockquote>While there are several updates in 0.4.2<ref name="eosnetworkfoundationgithub-11036" />, the specific modifications to correct the vulnerability apply to two separate files within the silkworm module<ref name=":4" />:

	"The EOS Network Foundation tweeted that the EOS EVM has released version v0.4.2, which fixes a serious security vulnerability found in the EOS EVM. The EOS EVM contracts, EOS EVM nodes, and EOS EVM RPC components implemented by the EOS mainnet all need to be upgraded."</blockquote>While there are several updates in 0.4.2<ref name="eosnetworkfoundationgithub-11036" />, the specific modifications to correct the vulnerability apply to two separate files within the silkworm module<ref name=":4" />:

	=== core/silkworm/state/delta.cpp ===		=== core/silkworm/state/delta.cpp ===
Line 93:		Line 116:

	if (changed_addresses.size() == 0) return Stage::Result::kSuccess;		if (changed_addresses.size() == 0) return Stage::Result::kSuccess;
	TBD - Need more details on the exploit itself.		TBD - Need more details on the exploit itself. For example, how could it be exploited by an attacker?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 127:		Line 150:
	The fix to the security vulnerability is technically a breaking change to EOS EVM, so it is possible that existing clients may still continue to run the old version of the EVN client. However, the exploit was never exploited, and it is unlikely that an attacker would want to exploit in a way that is likely to only affect a portion of current nodes and be easily resolved by the remaining nodes upgrading. Any assets they gained would only exist on a fork state of the EVM.		The fix to the security vulnerability is technically a breaking change to EOS EVM, so it is possible that existing clients may still continue to run the old version of the EVN client. However, the exploit was never exploited, and it is unlikely that an attacker would want to exploit in a way that is likely to only affect a portion of current nodes and be easily resolved by the remaining nodes upgrading. Any assets they gained would only exist on a fork state of the EVM.
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:~~Individuals~~:~~Placeholder~~}}		No funds were lost in this case, as the vulnerability was never exploited. However, there are still some strategies which can be undertaken to reduce the risk.

			{{Prevention:Individual:Avoid Using Smart Contracts}}

			{{Prevention:Individual:Store Funds Offline}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	{{Prevention:Platforms:~~Placeholder~~}}		No funds were lost in this case, as the vulnerability was never exploited. Further scrutiny by platforms using the EOS blockchain may have helped to uncover the vulnerability before it was exploited. It is also important to place more assets, particularly key treasury assets, within a simpler multi-signature arrangement, which would typically have a lot less risk than more complex smart contracts.

			{{Prevention:Platforms:Regular Audit Procedures}}

			{{Prevention:Platform:Implement Multi-Signature}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	No funds were lost in this case, as the vulnerability was never exploited.		No funds were lost in this case, as the vulnerability was never exploited. However, there are still some strategies which can be undertaken to reduce the risk.

	{{Prevention:Regulators:Blockchain Level Exploit Handling}}		{{Prevention:Regulators:Blockchain Level Exploit Handling}}

Azoundria: Another 30 minutes and the prevention section filled in now for regulators.

2023-05-29T17:11:24Z

Another 30 minutes and the prevention section filled in now for regulators.

← Older revision		Revision as of 11:11, 29 May 2023
Line 99:		Line 99:

	== Immediate Reactions ==		== Immediate Reactions ==
	~~How did the various parties involved (firm~~, ~~platform~~, ~~management~~, and/~~or affected individual(s)) deal with~~ the ~~events? Were services shut down? Were announcements made? Were groups formed?~~		According to release notes, three developers @yarkinwho, @spoonincode, and @taokayan were responsible for investigation and resolution of the vulnerability<ref name=":3" />. Developer @taokayan was responsible for the actual proposal to resolve the vulnerability<ref name=":4" />.

	"The EOS Network Foundation ~~tweeted that the EOS EVM has~~ released version v0.4.2, which ~~fixes a serious security~~ vulnerability ~~found in~~ the ~~EOS EVM. The EOS~~ EVM ~~contracts~~, ~~EOS~~ EVM nodes, and ~~EOS~~ EVM RPC components ~~implemented by the EOS mainnet all need to be upgraded~~."		The EOS Network Foundation ultimately released version 0.4.2 of their Ethereum Virtual Machine, which resolved the vulnerability. This required an upgrade to the EVM smart contract, EVM nodes, and EVM RPC components<ref name="eosnetworkfoundationgithub-11035" />.

	~~"The EOS EVM Contract, EOS EVM Node, and EOS EVM RPC for~~ the ~~EOS mainnet implementation have already been patched prior to this public release."~~		While the resolution was technically a breaking change, this wasn't a fatal problem as the vulnerability had never been exploited<ref name="eosnetworkfoundationgithub-11035" />.

	~~"The fix to the security vulnerability is~~ technically a breaking change ~~to EOS EVM. However~~, the vulnerability ~~does not appear to have~~ been exploited ~~on either the EOS EVM testnet or mainnet. Therefore, it becomes possible to treat the fix as simpler retroactive change of the EVM."~~

	<ref name="eosnetworkfoundationgithub-11035" />


	~~According to the release notes, the following developers were responsible for assisting with the investigation and resolution:~~

	* @yarkinwho
	* @spoonincode
	* @taokayan<ref name=":3" />

	== Ultimate Outcome ==		== Ultimate Outcome ==
Line 126:		Line 115:
	The EOS EVM Contract, EOS EVM Node, and EOS EVM RPC for the EOS mainnet implementation have already been patched prior to this public release.</blockquote>		The EOS EVM Contract, EOS EVM Node, and EOS EVM RPC for the EOS mainnet implementation have already been patched prior to this public release.</blockquote>

			=== Required Upgrades ===
	"Upgrading EOS EVM Contract from v0.4.1 simply requires a setcode of the v0.4.2 contract. There are no changes to the ABI."		It was reported that there was no change required to the Application Binary Interface (ABI)<ref name="eosnetworkfoundationgithub-11035" />, making the smart contract upgrade easy.<blockquote>
			"Upgrading EOS EVM Contract from v0.4.1 simply requires a setcode of the v0.4.2 contract. There are no changes to the ABI."</blockquote>At the same time, the node and RPC services needed to have their binaries updated and then be restarted<ref name="eosnetworkfoundationgithub-11035" />.<blockquote>"Upgrading EOS EVM Node and EOS EVM RPC from v0.4.1 only requires restarting the services with the updated binaries."</blockquote>

	== Total Amount Recovered ==		== Total Amount Recovered ==
Line 147:		Line 137:

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	{{Prevention:Regulators:~~Placeholder~~}}		No funds were lost in this case, as the vulnerability was never exploited.

			{{Prevention:Regulators:Blockchain Level Exploit Handling}}

			{{Prevention:Regulators:Establish Industry Insurance Fund}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria: Another 30 minutes complete.

2023-05-25T23:56:35Z

Another 30 minutes complete.

← Older revision		Revision as of 17:56, 25 May 2023
Line 22:		Line 22:
	=== Sending EVM-Compatible Transactions ===		=== Sending EVM-Compatible Transactions ===
	Clients can push transactions via a proxy and the transaction wrapper. This encapsulates the EVM transaction into an Antelope smart contract transaction. The EVM transactions are then validated and executed by the EOS EVM smart contract deployed in the EOS blockchain<ref name=":2" />.		Clients can push transactions via a proxy and the transaction wrapper. This encapsulates the EVM transaction into an Antelope smart contract transaction. The EVM transactions are then validated and executed by the EOS EVM smart contract deployed in the EOS blockchain<ref name=":2" />.

	~~== Include: ==~~
	* What problems does the company or service claim to solve?
	* What marketing materials were used by the firm or business?
	* Audits performed, and excerpts that may have been included.
	* Business registration documents shown (fake or legitimate).
	* How were people recruited to participate?
	* Public warnings and announcements prior to the event.

	~~Don't Include:~~
	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.
	~~There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.~~

	== The Reality ==		== The Reality ==

			The EOS EVM contained a critical security vulnerability. The security vulnerability related to "state objects" tracking the reserved addresses of the trustless bridge. The tracking was not properly being undone in the case where the EVM execution context was reverted<ref name="eosnetworkfoundationgithub-11036" />.

	"The ~~security~~ vulnerability is related to the state objects tracking the reserved addresses of the trustless bridge and how they were not properly being undone in the case of an EVM execution context being reverted. If exploited, it could potentially allow an attacker to illegitimately drain all of the EOS stored by the EOS EVM ~~Contract~~ across the trustless bridge."<ref name="eosnetworkfoundationgithub-11036" />		The vulnerability could potentially allow an attacker to illegitimately drain all of the EOS stored by the EOS EVM smart contract across the trustless bridge<ref name="eosnetworkfoundationgithub-11036" />.

	~~This sections is included if a case involved deception or information that was unknown at the time~~. ~~Examples include:~~

	* When the ~~service was actually started (if different than the "official story").~~		TBD - Need to fill in more details on the exact exploit and how it was introduced into the source code.
	* Who actually ran a service and ~~their own personal history.~~
	* How the service was ~~structured behind~~ the ~~scenes. (For example, there was no "trading bot".)~~
	* Details of what audits reported and how vulnerabilities were missed during auditing.

	~~TBD - Need to fill in more details on~~ the ~~exact exploit~~ and ~~how it happened~~.		The vulnerability primarily affected the EOS EVM smart contract, although the EOS EVM node, and the EOS EVM RPC would expect the failed behaviour.
	== What Happened ==		== What Happened ==
	The vulnerability was kept confidential and patched behind the scenes by the EOS team. They released an update to the EOS EVM on May 15th.		The vulnerability was kept confidential and patched behind the scenes by the EOS team. They released an update to the EOS EVM on May 15th.
Line 56:		Line 39:
	!Event		!Event
	!Description		!Description
			\|-
			\|May 11th, 2023 12:20:00 AM MDT
			\|taokayan Provides Silkwork Stability Fix
			\|EOS developer taokayan<ref name=":3">[https://github.com/taokayan taokayan - Github] (May 25, 2023)</ref> commits a fix to the silkworm module<ref name=":4">[https://github.com/eosnetworkfoundation/silkworm/compare/2447b4a3272e69854d311f65e55d0d1902a7e16a...1ac4f7c72a947591b62b2b4af4965351144127ac#diff-f720d0f896184212c9d6088db971d2b35aa88675765b03a2690f5fce9de2137f Comparing Silkworm Stability Fixes - eosnetworkfoundation/silkworm - GitHub] (May 25, 2023)</ref>.
			\|-
			\|May 11th, 2023 7:50:00 PM MDT
			\|Version Bumped To 0.4.2
			\|The EOS EVM software version is bumped up to 0.4.2<ref name="eosnetworkfoundationgithub-11036" />.
	\|-		\|-
	\|May 15th, 2023 7:07:00 PM MDT		\|May 15th, 2023 7:07:00 PM MDT
Line 71:		Line 62:

	== Technical Details ==		== Technical Details ==
	~~This section includes specific detailed technical analysis of any~~ security ~~breaches which happened. What specific software vulnerabilities contributed~~ to the ~~problem~~ and how were ~~they~~ exploited?		According to the release notes.<ref name="eosnetworkfoundationgithub-11035" /><blockquote>"The security vulnerability is related to the state objects tracking the reserved addresses of the trustless bridge and how they were not properly being undone in the case of an EVM execution context being reverted. If exploited, it could potentially allow an attacker to illegitimately drain all of the EOS stored by the EOS EVM Contract across the trustless bridge."

	~~Need more details on~~ the ~~exploit itself~~.		"The EOS Network Foundation tweeted that the EOS EVM has released version v0.4.2, which fixes a serious security vulnerability found in the EOS EVM. The EOS EVM contracts, EOS EVM nodes, and EOS EVM RPC components implemented by the EOS mainnet all need to be upgraded."</blockquote>While there are several updates in 0.4.2<ref name="eosnetworkfoundationgithub-11036" />, the specific modifications to correct the vulnerability apply to two separate files within the silkworm module<ref name=":4" />:

	~~Release Notes:<ref name~~=~~"eosnetworkfoundationgithub-11035"~~ />		=== core/silkworm/state/delta.cpp ===
			void CreateDelta::revert(IntraBlockState& state) noexcept {
			if(is_reserved_address(address_))
			state.reserved_objects_.erase(address_);
			else
			state.objects_.erase(address_);
			}

	~~About The Upgrade~~:~~<ref name~~=~~"eosnetworkfoundationgithub-11036" />~~		void UpdateDelta::revert(IntraBlockState& state) noexcept {
			if(is_reserved_address(address_))
			state.reserved_objects_[address_] = previous_;
			else
			state.objects_[address_] = previous_;
			}

	~~"The security vulnerability is related to the~~ state ~~objects tracking the reserved addresses of the trustless bridge and how they were not properly being undone in the case of an EVM execution context being reverted~~. ~~If exploited, it could potentially allow an attacker to illegitimately drain all of the EOS stored by the EOS EVM Contract across the trustless bridge~~."		void UpdateBalanceDelta::revert(IntraBlockState& state) noexcept {
			if(is_reserved_address(address_))
			state.reserved_objects_[address_].current->balance = previous_;
			else
			state.objects_[address_].current->balance = previous_;
			}

	~~"The EOS Network Foundation tweeted that the EOS EVM has released version v0~~.~~4.2~~, ~~which fixes a serious security vulnerability found in the EOS EVM~~. ~~The EOS EVM contracts, EOS EVM nodes, and EOS EVM RPC components implemented by~~ the ~~EOS mainnet all need to be upgraded~~."		=== core/silkworm/stagedsync/stage_hashstate.cpp ===
			Stage::Result HashState::write_changes_from_changed_addresses(db::RWTxn& txn, const ChangedAddresses& changed_addresses) {
			throw_if_stopping();

			if (changed_addresses.size() == 0) return Stage::Result::kSuccess;
			TBD - Need more details on the exploit itself.

	== Total Amount Lost ==		== Total Amount Lost ==
	There were no funds lost since the EOS EVM ~~Contract, EOS EVM Node, and EOS EVM RPC for the EOS mainnet implementation were~~ patched prior to a public release of any information. The ~~fix to the security vulnerability is technically a breaking change to EOS EVM. However, the~~ vulnerability does not appear to have been exploited on either the EOS EVM testnet or mainnet. Therefore, it was possible to treat the fix as simpler retroactive change of the EVM. It does not appear that any bounty was paid out for discovering the vulnerability either.		There were no funds lost since the EOS EVM smart contract was patched prior to a public release of any information. The vulnerability does not appear to have been exploited on either the EOS EVM testnet or mainnet. Therefore, it was possible to treat the fix as simpler retroactive change of the EVM. It does not appear that any bounty was paid out for discovering the vulnerability either.

	== Immediate Reactions ==		== Immediate Reactions ==
Line 102:		Line 114:
	* @yarkinwho		* @yarkinwho
	* @spoonincode		* @spoonincode
	* @taokayan		* @taokayan<ref name=":3" />

	== Ultimate Outcome ==		== Ultimate Outcome ==
Line 122:		Line 134:
	== Ongoing Developments ==		== Ongoing Developments ==
	There don't appear to be any remaining developments in this case. The original vulnerability has already been patched by the EOS team.		There don't appear to be any remaining developments in this case. The original vulnerability has already been patched by the EOS team.

			The fix to the security vulnerability is technically a breaking change to EOS EVM, so it is possible that existing clients may still continue to run the old version of the EVN client. However, the exploit was never exploited, and it is unlikely that an attacker would want to exploit in a way that is likely to only affect a portion of current nodes and be easily resolved by the remaining nodes upgrading. Any assets they gained would only exist on a fork state of the EVM.
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:Individuals:Placeholder}}		{{Prevention:Individuals:Placeholder}}

Azoundria: Completed another 30 minutes.

2023-05-24T20:01:40Z

Completed another 30 minutes.

← Older revision		Revision as of 14:01, 24 May 2023
Line 2:		Line 2:

	== About EOS Blockchain ==		== About EOS Blockchain ==
	<ref name="eosfoundation-7797" /><ref name="~~datadriveninvestormedium~~-~~7803"~~ />		The EOS (Electro-Optical System<ref name=":1">[https://www.investopedia.com/tech/what-is-eos/ EOS Tokens Defined: The Basics and Examples - Investopedia] (May 24, 2023)</ref>) blockchain is "a highly performant open-source blockchain platform, built to support and operate safe, compliant, and predictable digital infrastructures."<ref name="eosfoundation-7797" /> EOS launched in June 2018 with a $4.1 billion USD initial coin offering<ref name=":1" />. The core team of EOS is based in the Cayman Islands<ref>[https://blockgeeks.com/guides/eos-blockchain/ What is EOS Blockchain: Beginners Guide - BlockGeeks] (May 24, 2023)</ref>.<blockquote>The core team behind EOS is “Block.one”, which is based in the Cayman Islands. Brendon Blumer, the CEO, has been involved in blockchain since 2014. He has previously been involved in companies that dealt with currency exchanges in MMORPGs and in real estate.

	"EOS is a platform that uses the blockchain technology for the development of decentralized applications (dapps), very similar to Ethereum in function. As a matter of fact, supporters have dubbed it as the “Ethereum killer”. By providing an operating-system-like set of services and features that dapps can make use of, it makes dapp development very easy."		Dan Larimer, is the CTO. He is the creator of delegated proof-of-stake and decentralized autonomous organizations aka DAOs. He is the also the man behind BitShares and Steem.</blockquote>The EOS platform allows the development of decentralized blockchain applications in a similar manner to Ethereum and was initially dubbed the ethereum killer<ref name="datadriveninvestormedium-7803" />.<blockquote>"EOS is a platform that uses the blockchain technology for the development of decentralized applications (dapps), very similar to Ethereum in function. As a matter of fact, supporters have dubbed it as the “Ethereum killer”. By providing an operating-system-like set of services and features that dapps can make use of, it makes dapp development very easy."</blockquote>

	~~"EOSIO~~ is a ~~highly performant open-source~~ blockchain ~~platform, built to support~~ and ~~operate safe, compliant~~, ~~and predictable digital infrastructures~~.~~" "EOSIO~~ is a ~~leading open-source software for blockchain innovation~~ and ~~performance. As one~~ of the ~~most performant~~, ~~customizable~~, and ~~secure~~ blockchains ~~available, it offers industry-leading speed, scalability, configurability, and the latest security standards~~." "~~Block~~.~~one is also the originator of EOSIO, the leading open~~-~~source blockchain software that provides developers and businesses with the tools to build the infrastructure of tomorrow~~."		== About EOS EVM ==
			EVM, or the Ethereum Virtual Machine, is a core computation engine of Ethereum which powers the blockchain and smart contracts<ref>[https://www.quicknode.com/guides/ethereum-development/getting-started/what-is-the-ethereum-virtual-machine-evm/ What is the Ethereum Virtual Machine (EVM)? - QuickNode] (May 24, 2023)</ref>. The EOS EVM is a compatibility layer that's designed to allow EOS to mimic the same functionality as the EVM. "It enables developers to deploy and run their applications on top of the EOS blockchain infrastructure but to build, test, and debug those applications using the common languages and tools they are used to using with other EVM compatible blockchains.<ref name=":2">[https://github.com/eosnetworkfoundation/eos-evm/ EOS EVM Readme.md - Github] (May 24, 2023)</ref>"

			The EOS EVM allows EOS developers access to use all of the tools and code which are available for Ethereum development on EOS. There are five parts to the EOS EVM<ref name=":2" />:

			* A fork of the Blockscout blockchain explorer with adaptations for the EOS EVM.
			* The EVM bridge front-end, a front-end which allows for the operation of the EVM trustless bridge<ref>[https://github.com/eosnetworkfoundation/evm-bridge-frontend evm-bridge-frontend - Github] (May 24, 2023)</ref>.
			* The EOS EVM contract, an Antelope smart contract implementing the main runtime for the EVM.
			* The EOS EVM Node and RPC (remote procedure call). This allows for the operation of EVM nodes and remote interaction with those nodes.
			* The transaction wrapper, an Node.js application to service the eth_sendRawTransaction and eth_gasPrice functions.

	~~Include~~:		=== Getting Blockchain Information ===
			The EOS EVM allows for a blockchain which is built in a deterministic way. Through the RPC, clients such as MetaMask can gain a read-only view of the blockchain<ref name=":2" />.

	* Known history of when and ~~how~~ the ~~service was started~~.		=== Sending EVM-Compatible Transactions ===
			Clients can push transactions via a proxy and the transaction wrapper. This encapsulates the EVM transaction into an Antelope smart contract transaction. The EVM transactions are then validated and executed by the EOS EVM smart contract deployed in the EOS blockchain<ref name=":2" />.

			== Include: ==
	* What problems does the company or service claim to solve?		* What problems does the company or service claim to solve?
	* What marketing materials were used by the firm or business?		* What marketing materials were used by the firm or business?
Line 26:		Line 37:

	== The Reality ==		== The Reality ==


	"The security vulnerability is related to the state objects tracking the reserved addresses of the trustless bridge and how they were not properly being undone in the case of an EVM execution context being reverted. If exploited, it could potentially allow an attacker to illegitimately drain all of the EOS stored by the EOS EVM Contract across the trustless bridge."<ref name="eosnetworkfoundationgithub-11036" />		"The security vulnerability is related to the state objects tracking the reserved addresses of the trustless bridge and how they were not properly being undone in the case of an EVM execution context being reverted. If exploited, it could potentially allow an attacker to illegitimately drain all of the EOS stored by the EOS EVM Contract across the trustless bridge."<ref name="eosnetworkfoundationgithub-11036" />

Line 51:		Line 64:
	\|Included In SlowMist		\|Included In SlowMist
	\|The vulnerability is included as an exploit on the SlowMist website<ref name="slowmisthackedarchive-10953" />.		\|The vulnerability is included as an exploit on the SlowMist website<ref name="slowmisthackedarchive-10953" />.
			\|-
			\|May 22nd, 2023 7:37:11 AM MDT
			\|EOS GO Publication on Vulnerability
			\|The EOS GO publishes information about the vulnerability in the weekly newsletter<ref>[https://web.archive.org/web/20230522133711/https://www.eosgo.io/news/this-week-progress-and-direction-of-the-eos-comeback/ This Week: Progress and Direction of the EOS Comeback - EOS GO Archive May 22nd, 2023 7:37:11 AM MDT] (May 24, 2023)</ref><ref>[https://www.eosgo.io/news/this-week-progress-and-direction-of-the-eos-comeback/ This Week: Progress and Direction of the EOS Comeback - EOS GO] (May 24, 2023)</ref>.
	\|}		\|}

Line 126:		Line 143:
	<ref name="eosnetworkfoundationgithub-11035">[https://github.com/eosnetworkfoundation/eos-evm/releases/tag/v0.4.2 Release EOS EVM v0.4.2 Release Notes · eosnetworkfoundation/eos-evm · GitHub] (May 19, 2023)</ref>		<ref name="eosnetworkfoundationgithub-11035">[https://github.com/eosnetworkfoundation/eos-evm/releases/tag/v0.4.2 Release EOS EVM v0.4.2 Release Notes · eosnetworkfoundation/eos-evm · GitHub] (May 19, 2023)</ref>
	<ref name="eosnetworkfoundationgithub-11036">[https://github.com/eosnetworkfoundation/eos-evm/compare/v0.4.1...v0.4.2 Comparing v0.4.1...v0.4.2 · eosnetworkfoundation/eos-evm · GitHub] (May 19, 2023)</ref>		<ref name="eosnetworkfoundationgithub-11036">[https://github.com/eosnetworkfoundation/eos-evm/compare/v0.4.1...v0.4.2 Comparing v0.4.1...v0.4.2 · eosnetworkfoundation/eos-evm · GitHub] (May 19, 2023)</ref>
	<ref name="eosfoundation-7797">https://eos.io/ (May 29, 2022)</ref>		<ref name="eosfoundation-7797">[https://eos.io/ EOSIO Blockchain Software & Services Homepage] (May 29, 2022)</ref>
	<ref name="datadriveninvestormedium-7803">https://medium.datadriveninvestor.com/eos-oversimplified-a-beginners-guide-to-eos-io-cryptocurrency-4b1ee4465736~~?gi=f62babde20e3~~ (May 29, 2022)</ref>		<ref name="datadriveninvestormedium-7803">[https://medium.datadriveninvestor.com/eos-oversimplified-a-beginners-guide-to-eos-io-cryptocurrency-4b1ee4465736 EOS Oversimplified: A Beginners Guide To EOS.IO Cryptocurrency - DataDrivenInvestor Medium] (May 29, 2022)</ref>
	</references>		</references>

Azoundria: Complete the full 30 minutes.

2023-05-19T18:08:50Z

Complete the full 30 minutes.

← Older revision		Revision as of 12:08, 19 May 2023
Line 35:		Line 35:
	* Details of what audits reported and how vulnerabilities were missed during auditing.		* Details of what audits reported and how vulnerabilities were missed during auditing.

			TBD - Need to fill in more details on the exact exploit and how it happened.
	== What Happened ==		== What Happened ==
	The vulnerability was kept confidential and patched behind the scenes by the EOS team. They released an update to the EOS EVM on May 15th.		The vulnerability was kept confidential and patched behind the scenes by the EOS team. They released an update to the EOS EVM on May 15th.
Line 55:		Line 55:
	== Technical Details ==		== Technical Details ==
	This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?		This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

			Need more details on the exploit itself.

	Release Notes:<ref name="eosnetworkfoundationgithub-11035" />		Release Notes:<ref name="eosnetworkfoundationgithub-11035" />
Line 65:		Line 67:

	== Total Amount Lost ==		== Total Amount Lost ==
	~~"The~~ EOS EVM Contract, EOS EVM Node, and EOS EVM RPC for the EOS mainnet implementation ~~have already been~~ patched prior to ~~this~~ public release."		There were no funds lost since the EOS EVM Contract, EOS EVM Node, and EOS EVM RPC for the EOS mainnet implementation were patched prior to a public release of any information. The fix to the security vulnerability is technically a breaking change to EOS EVM. However, the vulnerability does not appear to have been exploited on either the EOS EVM testnet or mainnet. Therefore, it was possible to treat the fix as simpler retroactive change of the EVM. It does not appear that any bounty was paid out for discovering the vulnerability either.

	"The fix to the security vulnerability is technically a breaking change to EOS EVM. However, the vulnerability does not appear to have been exploited on either the EOS EVM testnet or mainnet. Therefore, it ~~becomes~~ possible to treat the fix as simpler retroactive change of the EVM."

	~~No funds were lost.~~

	~~How much~~ was ~~lost and how was it calculated? If there are conflicting reports, which are accurate and where does~~ the ~~discrepancy lie?~~

	== Immediate Reactions ==		== Immediate Reactions ==
Line 92:		Line 88:

	== Ultimate Outcome ==		== Ultimate Outcome ==
	~~What was~~ the ~~end result? Was any investigation done? Were any individuals prosecuted? Was there~~ a ~~lawsuit? Was any tracing done?~~		The EOS Foundation announced the resolution on Twitter with a new version of the EVM being released for people to download.

	=== EOS Foundation Announcement on Twitter ===		=== EOS Foundation Announcement on Twitter ===
Line 105:		Line 101:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~There do not appear to have been any~~ funds ~~recovered~~ in this case.		No funds were lost in this case, and therefore no recovery was needed.

	~~What funds were recovered? What funds were reimbursed for those affected users?~~

	== Ongoing Developments ==		== Ongoing Developments ==

Azoundria: Starting initial edit.

2023-05-19T17:30:32Z

Starting initial edit.

Show changes

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/eosevmcontractdrainvulnerability.php}} {{Unattributed Sources}} EOS.io LogoA critical vulnerability was uncovered and resolved in the EOS EVM before it could be exploited. The vulnerability, if exploited, would have allowed draining all contracts storing EOS across the trustless bridge. This is a global/international case not involving a specific country.
2023-05-19T17:12:32Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/eosevmcontractdrainvulnerability.php}} {{Unattributed Sources}} thumb|EOS.io LogoA critical vulnerability was uncovered and resolved in the EOS EVM before it could be exploited. The vulnerability, if exploited, would have allowed draining all contracts storing EOS across the trustless bridge. This is a global/international case not involving a specific country.<ref name="slowmi..."

New page
{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/eosevmcontractdrainvulnerability.php}}
{{Unattributed Sources}}

[[File:Eosio.jpg|thumb|EOS.io Logo]]A critical vulnerability was uncovered and resolved in the EOS EVM before it could be exploited. The vulnerability, if exploited, would have allowed draining all contracts storing EOS across the trustless bridge.

This is a global/international case not involving a specific country.<ref name="slowmisthackedarchive-10953" /><ref name="eosnfoundationtwitterarchive-11034" /><ref name="eosnetworkfoundationgithub-11035" /><ref name="eosnetworkfoundationgithub-11036" /><ref name="eosfoundation-7797" /><ref name="datadriveninvestormedium-7803" />

== About EOS Blockchain ==
"EOS is a platform that uses the blockchain technology for the development of decentralized applications (dapps), very similar to Ethereum in function. As a matter of fact, supporters have dubbed it as the “Ethereum killer”. By providing an operating-system-like set of services and features that dapps can make use of, it makes dapp development very easy."

"EOSIO is a highly performant open-source blockchain platform, built to support and operate safe, compliant, and predictable digital infrastructures." "EOSIO is a leading open-source software for blockchain innovation and performance. As one of the most performant, customizable, and secure blockchains available, it offers industry-leading speed, scalability, configurability, and the latest security standards." "Block.one is also the originator of EOSIO, the leading open-source blockchain software that provides developers and businesses with the tools to build the infrastructure of tomorrow."

"The security vulnerability is related to the state objects tracking the reserved addresses of the trustless bridge and how they were not properly being undone in the case of an EVM execution context being reverted. If exploited, it could potentially allow an attacker to illegitimately drain all of the EOS stored by the EOS EVM Contract across the trustless bridge."

"The EOS Network Foundation tweeted that the EOS EVM has released version v0.4.2, which fixes a serious security vulnerability found in the EOS EVM. The EOS EVM contracts, EOS EVM nodes, and EOS EVM RPC components implemented by the EOS mainnet all need to be upgraded."

"The EOS EVM Contract, EOS EVM Node, and EOS EVM RPC for the EOS mainnet implementation have already been patched prior to this public release."

"The fix to the security vulnerability is technically a breaking change to EOS EVM. However, the vulnerability does not appear to have been exploited on either the EOS EVM testnet or mainnet. Therefore, it becomes possible to treat the fix as simpler retroactive change of the EVM."

"Upgrading EOS EVM Contract from v0.4.1 simply requires a setcode of the v0.4.2 contract. There are no changes to the ABI."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - EOS EVM Contract Drain Vulnerability
!Date
!Event
!Description
|-
|May 15th, 2023 7:07:00 PM MDT
|Upgrade Available
|The upgrage to the EVM is made available on Twitter.
|-
|May 16th, 2023
|Included In SlowMist
|The vulnerability is included as an exploit on the SlowMist website.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
No funds were lost.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="slowmisthackedarchive-10953">[https://web.archive.org/web/20230519161338/https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (May 19, 2023)</ref>

<ref name="eosnfoundationtwitterarchive-11034">[https://web.archive.org/web/20230519161338/https://twitter.com/EOSnFoundation/status/1658278077024161792 @EOSnFoundation Twitter] (May 19, 2023)</ref>

<ref name="eosnetworkfoundationgithub-11035">[https://github.com/eosnetworkfoundation/eos-evm/releases/tag/v0.4.2 Release EOS EVM v0.4.2 Release Notes · eosnetworkfoundation/eos-evm · GitHub] (May 19, 2023)</ref>

<ref name="eosnetworkfoundationgithub-11036">[https://github.com/eosnetworkfoundation/eos-evm/compare/v0.4.1...v0.4.2 Comparing v0.4.1...v0.4.2 · eosnetworkfoundation/eos-evm · GitHub] (May 19, 2023)</ref>

<ref name="eosfoundation-7797">[https://eos.io/ https://eos.io/] (May 29, 2022)</ref>

<ref name="datadriveninvestormedium-7803">[https://medium.datadriveninvestor.com/eos-oversimplified-a-beginners-guide-to-eos-io-cryptocurrency-4b1ee4465736?gi=f62babde20e3 https://medium.datadriveninvestor.com/eos-oversimplified-a-beginners-guide-to-eos-io-cryptocurrency-4b1ee4465736?gi=f62babde20e3] (May 29, 2022)</ref></references>