Analysis of Common Attack Methods in the Web3 Field in the First Half of 2022

In the first half of 2022, the Web3 security sector faced severe challenges. Data shows that there were 42 major attack incidents caused solely by contract vulnerabilities, resulting in total losses of up to $644 million. Among these attacks, logical or function design flaws were the most commonly exploited vulnerabilities by hackers, followed by verification issues and reentrancy vulnerabilities.

Major Loss Cases

On February 3, a certain cross-chain bridge project was attacked, resulting in a loss of approximately $326 million. The hacker exploited a signature verification vulnerability in the contract to successfully forge accounts and mint tokens.

On April 30, a lending protocol suffered a flash loan reentrancy attack, resulting in a loss of $80.34 million. This attack dealt a fatal blow to the project, ultimately leading to its closure.

The attacker implements the attack through the following steps:

1. Perform a flash loan from a certain liquidity pool
2. Exploiting the reentrancy vulnerability in contracts using cEther on lending platforms
3. Extract all tokens from the affected pool by attacking the contract.
4. Repay the flash loan and transfer the proceeds from the attack.

Common Vulnerability Types

During the smart contract audit process, the most common vulnerabilities can be divided into four major categories:

1. ERC721/ERC1155 Reentrancy Attack: Involves malicious code in the token transfer notification function.

2. Logical Flaw:
   • Insufficient consideration of special scenarios, such as self-transfer leading to the creation of something from nothing.
   • The functional design is not perfect, such as lacking extraction or settlement mechanisms.

3. Missing Authentication: Key functions have not set permission control

4. Price Manipulation:
   • Unused Time-Weighted Average Price
   • Directly use the token balance ratio in the contract as the price

Vulnerability Prevention

Almost all vulnerabilities found in the audit have been exploited by hackers in real scenarios. Among them, contract logic vulnerabilities remain the main attack point. Most of these vulnerabilities can be discovered during the audit phase through professional formal verification platforms and manual reviews by security experts.

To enhance the security of Web3 projects, it is recommended that the development team:

1. Conduct a comprehensive contract security audit
2. Emphasize special scenario testing
3. Implement strict permission management
4. Use reliable price oracles
5. Follow the "Check-Effect-Interaction" design pattern

As attack methods continue to evolve, ongoing security awareness and upgrades to protective measures are crucial for the healthy development of the Web3 ecosystem.