Analysis of the Poly Network protocol Hacker Attack Incident

Recently, the cross-chain interoperability protocol Poly Network was attacked by a Hacker, which has attracted widespread attention in the industry. The security team conducted an in-depth analysis of the incident and believes that the attacker cleverly constructed data to modify the keeper address of the EthCrossChainData contract, rather than the previously rumored keeper private key leakage being the cause.

Attack Core

The key to the attack lies in the verifyHeaderAndExecuteTx function of the EthCrossChainManager contract. This function can execute specific cross-chain transactions through the _executeCrossChainTx function. Since the owner of the EthCrossChainData contract is the EthCrossChainManager contract, the latter can call the putCurEpochConPubKeyBytes function of the former to change the contract's keeper.

The attacker uses the verifyHeaderAndExecuteTx function, passing in carefully crafted data, to invoke the putCurEpochConPubKeyBytes function of the EthCrossChainData contract from the _executeCrossChainTx function, thereby changing the keeper role to an address specified by the attacker. After this step is completed, the attacker can arbitrarily construct transactions and withdraw any amount of funds from the contract.

Attack Process

1. The attacker first changed the keeper by calling the putCurEpochConPubKeyBytes function through the verifyHeaderAndExecuteTx function of the EthCrossChainManager contract.

2. Subsequently, the attacker began to implement a series of attack transactions to extract funds from the contract.

3. Due to the modification of the keeper, other users' normal transactions were rejected.

4. Similar attack methods have also been applied on the Ethereum network.

Conclusion

The root cause of this attack lies in the fact that the keeper of the EthCrossChainData contract can be modified by the EthCrossChainManager contract, and the latter's verifyHeaderAndExecuteTx function can execute data provided by the user. The attacker exploited this vulnerability by constructing specific data, successfully changing the keeper address of the EthCrossChainData contract. This finding clarifies the previous erroneous rumor about the leakage of the keeper's private key.

This incident once again highlights the importance of cross-chain protocol security. For complex smart contract systems, especially those involving cross-chain operations, stricter security audits and risk assessments are needed. At the same time, this also reminds blockchain project developers to pay extra attention to issues of permission management and data validation to prevent similar security vulnerabilities from being exploited.