ATN discloses a major vulnerability in Ethereum contracts under special scenarios and reaches a strategic cooperation agreement with SlowMist (Released in 2018)

Vulnerability Assessment

Security level: High

Affected contract: atn-contracts

Impact: Causes a change in the total supply of ATN Token.

Event: On the morning of May 11, 2018 at 11:46 am, ATN’s technical team received an abnormal monitoring alert indicating that the supply of ATN tokens had changed. They quickly intervened and determined that the token contract had been attacked by hackers. The ATN technical team quickly identified a rare permission vulnerability that may occur when implementing the ERC223 standard recommended contract with the ds-auth library, and promptly patched the vulnerability, froze the hacker’s newly issued tokens, and tracked the hacker. Meanwhile, ATN worked closely with the third-party professional blockchain security organization, SlowMist Technology, to conduct a joint re-audit of the ATN contract. During the audit, the SlowMist security team recognized the ATN technical team’s quick response and efficient contract repair. The repaired contract successfully passed SlowMist’s rigorous security audit, and the contract security threat was eliminated.

Vulnerability Analysis and Attack Process

To enable the ATN receiving contract to have processing capabilities after the transfer, the ATN Token contract uses the extended ERC223 standard that is compatible with the ERC20 Token standard and incorporates the dapphub/ds-auth library. There are no issues when using ERC223 or ds-auth library separately, but when combined, hackers use a custom callback function to call the setOwner method and obtain advanced privileges. By exploiting this ERC223 method with the mixed vulnerability of the ds-auth library, the hacker changed the owner of the ATN Token contract to an address they controlled. After obtaining owner privileges, the hacker initiated another transaction to attack the ATN contract, calling the mint method to issue Tokens to another address. Finally, the hacker called the setOwner method to restore permissions.

Defending Against the Attack

Upon investigation, it was discovered that the hacker had distributed the newly minted ATN Tokens across 14 different addresses with no ETH, eliminating the immediate risk of transferring them to an exchange to launder the stolen funds. The ATN technical team has the capability to freeze the hacker’s black coins and restore the supply volume changes using technical measures. Therefore, the primary focus is on how to track down the hacker. To address this issue, the ATN technical team took the following actions:

1. Preparations for corrective measures include adding a Guard contract to prohibit sending ATN to the ATN contract address, thereby preventing custom callback functions from calling the ATN contract itself to fix the vulnerability exploited in the attack. A blacklist contract will also be added to freeze hacker addresses at any time.
2. Monitoring the hacker’s ETH addresses, tracking the deposits sent to exchanges, in order to obtain further evidence for accountability.
3. After obtaining evidence, immediately initiate the repair process by adding the hacker’s related addresses to the blacklist and prohibiting the transfer of ATN Token;
4. The ATN Foundation will destroy an equivalent amount of ATN Tokens to restore the total supply, and will make corrections when the ATN main chain goes online.

After monitoring, the ATN team discovered that the hacker had deposited 1000 ATN to an exchange. The team immediately deployed the Guard security repair contract, prohibiting the hacker’s relevant address from conducting transfers, and obtained evidence for further legal action.

https://etherscan.io/tx/0x18bd80b810f6a6b6d397901d677657d39f8471069bcb7cfbf490c1946dfd617d

This means that we may be able to obtain the KYC information of the hacker, and the ATN team can track the hacker with the cooperation of the exchange and reserve the right to pursue responsibility.

The ATN Foundation will destroy 11 million ATN tokens to restore the total supply and remove the assets from the hacker’s address during the mapping on the main chain to ensure the original fixed total supply remains unchanged.

Features of ATN Token based on ERC223

1. ERC223 is an improvement on and compatible with ERC20, providing better token functionality that enables the receiving contract to have transfer and post-transfer processing capabilities. To learn more, visit https://github.com/ethereum/EIPs/issues/223. It also supports cross-chain functionality and can be used for cross-chain token payments in the AI Market.
2. Because the original design of the ATN Token includes its use as fuel for transactions, users or DApps can use ATN for payment, and the ATN token contract needs to have the ability to trigger other business logic after the transaction is completed.
3. Furthermore, ERC20 tokens cannot be used to publish crowdfunding contracts, but ATN based on ERC223 can be used for that purpose. You can refer to the ATN Swap contract.

Summary

Contracts are no trivial matter. Due to the complexity and added governance mechanisms of the ATN contract, auditing it was difficult and required several internal and external audits before it was deployed onto the chain. The security of blockchain contracts cannot rely solely on the developer’s experience and capabilities. The past few contract vulnerabilities, such as the notorious TheDAO hack and recent ERC20 attacks on EDU, BAIC, and SMT, have highlighted this issue.

However, the ATN technical team relied on their extensive contract deployment experience, solid technical expertise, and rapid response strategies to almost entirely mitigate the damage caused by this hacker, safeguarding the overall interests of the community and reserving the right to hold the hacker accountable.

This successful defense against the Ethereum contract vulnerability attack by ATN has also provided other members of the Ethereum community who use the ERC223 standard with a vulnerability review and repair case, contributing positively to the development of the entire Ethereum ecosystem.

Before the ATN mainnet launch, the ATN technical team will continue to monitor the contracts and token status in real-time and collaborate with multiple security auditing firms such as SlowMist Technology. The code will be open-sourced before the mainnet launch to ensure the open-source and security of the future ATN public chain ecosystem.

ATN Reached a Strategic Cooperation with SlowMist

SlowMist is a company that focuses on blockchain security, and its founding team has rich experience in network security. Members of the team have provided security capabilities for companies and government agencies such as Google, Microsoft, W3C, the Chinese Ministry of Public Security, Tencent, Alibaba, and Baidu. Their core capabilities include security audits, defense deployments, and underground hacker trend tracking and defense.

After fixing the vulnerability, the ATN team immediately contacted SlowMist, provided the “ATN Resists Hacker Attacks Report” (https://atn.io/resource/aareport.pdf), and fully cooperated with SlowMist to conduct a strict and comprehensive security audit of the ATN contract. Finally, SlowMist gave a positive security audit result and released the security audit report of the ATN contract based on ERC223.

ATN has launched the main chain acceleration plan and will have long-term strategic cooperation with security organizations such as SlowMist in contract and node security standards, operating environment, and risk control. The cooperation between the two sides will not only escort the upcoming launch of the ATN main chain but also contribute to the continuous construction of long-term blockchain ecosystem security.

About SlowMist

SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, O3Swap, etc.

Website：
https://www.slowmist.com
Twitter：
https://twitter.com/SlowMist_Team
Github：
https://github.com/slowmist/