EOS EVM Contract Drain Vulnerability

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

EOS.io Logo

A critical vulnerability was uncovered and resolved in the EOS EVM before it could be exploited. The vulnerability, if exploited, would have allowed draining all contracts storing EOS across the trustless bridge. According to the report, the vulnerability was never exploited.

About EOS Blockchain

The EOS (Electro-Optical System) blockchain is "a highly performant open-source blockchain platform, built to support and operate safe, compliant, and predictable digital infrastructures." EOS launched in June 2018 with a $4.1 billion USD initial coin offering. The core team of EOS is based in the Cayman Islands.

The core team behind EOS is “Block.one”, which is based in the Cayman Islands. Brendon Blumer, the CEO, has been involved in blockchain since 2014. He has previously been involved in companies that dealt with currency exchanges in MMORPGs and in real estate. Dan Larimer, is the CTO. He is the creator of delegated proof-of-stake and decentralized autonomous organizations aka DAOs. He is the also the man behind BitShares and Steem.

The EOS platform allows the development of decentralized blockchain applications in a similar manner to Ethereum and was initially dubbed the ethereum killer.

"EOS is a platform that uses the blockchain technology for the development of decentralized applications (dapps), very similar to Ethereum in function. As a matter of fact, supporters have dubbed it as the “Ethereum killer”. By providing an operating-system-like set of services and features that dapps can make use of, it makes dapp development very easy."

About EOS EVM

EVM, or the Ethereum Virtual Machine, is a core computation engine of Ethereum which powers the blockchain and smart contracts. The EOS EVM is a compatibility layer that's designed to allow EOS to mimic the same functionality as the EVM. "It enables developers to deploy and run their applications on top of the EOS blockchain infrastructure but to build, test, and debug those applications using the common languages and tools they are used to using with other EVM compatible blockchains."

The EOS EVM allows EOS developers access to use all of the tools and code which are available for Ethereum development on EOS. There are five parts to the EOS EVM:

• A fork of the Blockscout blockchain explorer with adaptations for the EOS EVM.
• The EVM bridge front-end, a front-end which allows for the operation of the EVM trustless bridge.
• The EOS EVM contract, an Antelope smart contract implementing the main runtime for the EVM.
• The EOS EVM Node and RPC (remote procedure call). This allows for the operation of EVM nodes and remote interaction with those nodes.
• The transaction wrapper, an Node.js application to service the eth_sendRawTransaction and eth_gasPrice functions.

Getting Blockchain Information

The EOS EVM allows for a blockchain which is built in a deterministic way. Through the RPC, clients such as MetaMask can gain a read-only view of the blockchain.

Sending EVM-Compatible Transactions

Clients can push transactions via a proxy and the transaction wrapper. This encapsulates the EVM transaction into an Antelope smart contract transaction. The EVM transactions are then validated and executed by the EOS EVM smart contract deployed in the EOS blockchain.

Include:

• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

"The security vulnerability is related to the state objects tracking the reserved addresses of the trustless bridge and how they were not properly being undone in the case of an EVM execution context being reverted. If exploited, it could potentially allow an attacker to illegitimately drain all of the EOS stored by the EOS EVM Contract across the trustless bridge."

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

TBD - Need to fill in more details on the exact exploit and how it happened.

What Happened

The vulnerability was kept confidential and patched behind the scenes by the EOS team. They released an update to the EOS EVM on May 15th.

Key Event Timeline - EOS EVM Contract Drain Vulnerability

Date	Event	Description
May 15th, 2023 7:07:00 PM MDT	Upgrade Available	The upgrage to the EVM is made available on Twitter.
May 16th, 2023	Included In SlowMist	The vulnerability is included as an exploit on the SlowMist website.
May 22nd, 2023 7:37:11 AM MDT	EOS GO Publication on Vulnerability	The EOS GO publishes information about the vulnerability in the weekly newsletter.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Need more details on the exploit itself.

Release Notes:

About The Upgrade:

"The security vulnerability is related to the state objects tracking the reserved addresses of the trustless bridge and how they were not properly being undone in the case of an EVM execution context being reverted. If exploited, it could potentially allow an attacker to illegitimately drain all of the EOS stored by the EOS EVM Contract across the trustless bridge."

"The EOS Network Foundation tweeted that the EOS EVM has released version v0.4.2, which fixes a serious security vulnerability found in the EOS EVM. The EOS EVM contracts, EOS EVM nodes, and EOS EVM RPC components implemented by the EOS mainnet all need to be upgraded."

Total Amount Lost

There were no funds lost since the EOS EVM Contract, EOS EVM Node, and EOS EVM RPC for the EOS mainnet implementation were patched prior to a public release of any information. The fix to the security vulnerability is technically a breaking change to EOS EVM. However, the vulnerability does not appear to have been exploited on either the EOS EVM testnet or mainnet. Therefore, it was possible to treat the fix as simpler retroactive change of the EVM. It does not appear that any bounty was paid out for discovering the vulnerability either.

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

"The EOS Network Foundation tweeted that the EOS EVM has released version v0.4.2, which fixes a serious security vulnerability found in the EOS EVM. The EOS EVM contracts, EOS EVM nodes, and EOS EVM RPC components implemented by the EOS mainnet all need to be upgraded."

"The EOS EVM Contract, EOS EVM Node, and EOS EVM RPC for the EOS mainnet implementation have already been patched prior to this public release."

"The fix to the security vulnerability is technically a breaking change to EOS EVM. However, the vulnerability does not appear to have been exploited on either the EOS EVM testnet or mainnet. Therefore, it becomes possible to treat the fix as simpler retroactive change of the EVM."

According to the release notes, the following developers were responsible for assisting with the investigation and resolution:

• @yarkinwho
• @spoonincode
• @taokayan

Ultimate Outcome

The EOS Foundation announced the resolution on Twitter with a new version of the EVM being released for people to download.

EOS Foundation Announcement on Twitter

The EOS Foundation posted on Twitter to announce the resolution of the vulnerability.

EOS EVM v0.4.2 Released!

This release fixes a critical security vulnerability discovered in the EOS EVM.

The EOS EVM Contract, EOS EVM Node, and EOS EVM RPC for the EOS mainnet implementation have already been patched prior to this public release.

"Upgrading EOS EVM Contract from v0.4.1 simply requires a setcode of the v0.4.2 contract. There are no changes to the ABI."

Total Amount Recovered

No funds were lost in this case, and therefore no recovery was needed.

Ongoing Developments

There don't appear to be any remaining developments in this case. The original vulnerability has already been patched by the EOS team.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.