Socket, an interoperability protocol, has fallen victim to a cybercriminal who managed to steal approximately $3.3 million.
The security incident occurred due to wallets with infinite approvals to Socket contracts. The project team issued a warning about the exploit yesterday, assuring that the problem had been identified, and the affected contracts were promptly paused. Just four hours after this announcement, the protocol was operational again.
Read also: Private Key Compromises and Exit Scams Are Current Major Web3 Threats
According to the Web3 security firm Beosin, the performAction function within the protocol contained an unsafe call, enabling a malicious actor to execute a call injection attack. Typically affecting smart contracts written in the Solidity programming language, this exploit allows criminals to inject malicious code into the call() function, designed to invoke other contracts. Such manipulation of the contract state empowers criminals to drain funds and alter the contract's rules or ownership.
Web3 developers can enhance code resistance against such attacks by avoiding the use of the call() function with user-supplied data. If avoidance is not feasible, implementing stringent validation and sanitization (procedures aiming to remove vulnerabilities from the code) mechanisms for user input becomes critical, as they act as barriers against the insertion of malicious code.
Unfortunately, in the case of Socket, none of these preventive measures were implemented.
In its X post, Beosin explained that the vulnerability arose from the oversight that the call "did not consider the case where the caller transfers in 0 WETH, allowing the caller to specify other functions in the call and still pass the balance check."
This flaw enabled the attacker to construct calldata in a manner allowing them to call the transferFrom() function of arbitrary tokens. Consequently, the attacker could transfer tokens, previously approved to the contract by other users, directly to the hacker’s designated address.
Alex Smirnov, co-founder of the deBridge platform powering cross-chain applications, commented on the security incident, stating that "Bridge aggregators pose way bigger risks to apps and users than bridges themselves."
Read also: Turbulent Start of 2024: Gamma Strategies, Radiant Capital Hacks and Solana Drainers
According to Smirnov, the vulnerability resided in the recent implementation of WrappedTokenSwapperImpl, which had been deployed three days before the hack. Similar to the observations made by the Beosin team, Smirnov highlighted the absence of a proper validation mechanism for swapExtraData in the performAction method.
Meanwhile, the Socket team cautions its users about phishing scammers seeking to exploit the news of the security breach. These scammers are currently distributing malicious links under the guise of a reimbursement program for the hack victims.
