GoPlus Security

GoPlus releases alert on "new type of predictive address attack": attackers exploit create2 feature to launch attacks for arbitrage

ChainCatcher news, according to official sources, security company GoPlus has issued an alert about a "new type of predicted address attack." It is reported that attackers exploit the characteristics of create2 to pre-calculate the blank address where the contract will be deployed, then deceive users into granting authorization. Since the blank address can bypass the security company's black address marking and security monitoring, once users authorize, the attackers will deploy the contract at this address and transfer the users' assets.In addition, this attack has the following characteristics:Create2 is a deployment method that can predict the generated contract address, allowing attackers to first deceive users into granting authorization and then deploy the contract.Since the contract is not deployed at the time of authorization, the attack address is an empty EOA address, so it will not be recorded by any detection tools, making it highly covert.GoPlus reminds users to be vigilant against phishing attacks from the source, to memorize commonly used protocol URLs or use browser bookmarks to manage official websites. Additionally, carefully check whether the authorized object is a blank (EOA) address during signature authorization, as there may be significant risks.

GoPlus Security and Slow Mist Security jointly submitted a time-limited authorization solution EIP, featuring automatic authorization recovery and other characteristics

Chaincatcher news, in response to the issue of user assets being stolen due to unlimited contract authorization, the Web3 security ecosystem infrastructure GoPlus Security has jointly submitted a time-limited authorization solution EIP with SlowMist Security here.It is reported that this solution has three new features: 1. Return control to users, allowing users to set the APPROVAL for their ERC-20 tokens, automatically reclaiming authorization using a default period, or customizing the time to achieve automatic reclamation of authorization, thus avoiding risks in a timely manner; 2. Fully compatible with the ERC20 standard, applications such as crypto wallets and DEXs can use the new features without any modifications; 3. Implementation-compliant proxy contracts can support this standard through upgrades.It is understood that while submitting the time-limited authorization EIP, GoPlus Security has also recently launched an authorization detection and management API. By integrating the API, various Web3 products can easily provide their users with a good authorization management experience, allowing users to see whether the authorized entity is safe, whether it is a malicious contract or an invalid contract, and also view the list of all contracts they have authorized to check for any risks.
ChainCatcher Building the Web3 world with innovators