SlowMist: Analysis of Smart Contract Vulnerabilities and Remediation Methods for BAI (Released in 2018)

On May 24th at 10:51, KKCoin reposted an announcement from the BAIC community.

On May 24th, in the early hours of the morning, the BAIC (BAI) project team discovered a large number of abnormal transactions with BAI and noticed several accounts with BAI holdings experiencing unusual transfers. Similar issues were also found in some other ERC20 projects, and it is believed to be a new vulnerability in the ERC20 smart contract based on preliminary analysis. To protect the interests of all BAI holders, the project team decided to immediately suspend trading of BAI on all exchanges and advised all BAI holders not to conduct private transactions or transfers to avoid losses. The project team will timely track the progress of the situation and handle it accordingly. We apologize for any inconvenience caused during the suspension of trading.

The SlowMist security team promptly analyzed the situation and found that BAI had the same smart contract vulnerability as EDU.

Vulnerability Analysis

In the BAI smart contract’s “transferFrom” function, there is no verification of whether “allowed[_from][msg.sender] >= _value” and the line “allowed[_from][msg.sender] -= _value;” does not use SafeMath. This causes an inability to throw an exception and roll back the transaction.

With this vulnerability, an attacker can transfer all the BAI in a specified account without needing the private key. Furthermore, since the contract lacks a Pause design, there is no way to stop the loss.

Repair Method

To fix the vulnerability, either add “require(allowed[_from][msg.sender] >= _value);” on the line below “require(balances[_from] >= _value);” or introduce SafeMath by adding “using SafeMath for uint256;” to the contract. Also, modify “allowed[_from][msg.sender] -= _value;” to “allowed[_from][msg.sender] = allowed[_from][msg.sender].sub(_value);” to prevent the vulnerability from being exploited.

About SlowMist

SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, O3Swap, etc.

Website：
https://www.slowmist.com
Twitter：
https://twitter.com/SlowMist_Team
Github：
https://github.com/slowmist/