learn-evm-attacks icon indicating copy to clipboard operation
learn-evm-attacks copied to clipboard

Published 20 hours ago • verified publisher icon coinspect

Feat: add Wintermute attack

Open nine-december opened this issue 2 years ago • 2 comments

On Sept 20, 2022 an attacker stole 160MM USD in OP tokens from Wintermute.

Attack Overview Total Lost: 160MM USD (20 MM OP)

Key Info Sources Writeup: https://rekt.news/wintermute-rekt-2/ Reproduction: https://github.com/SunWeb3Sec/DeFiHackLabs#20220608-optimism---wintermute

Principle: Business Logic - Vanity Address Generator Vuln?

nine-december avatar Nov 18 '22 16:11 nine-december

To reproduce this attack, it is needed that the receiver contract to have a specific address. Feature currently under development.

nine-december avatar Nov 22 '22 17:11 nine-december

I propose removing this from master until the attack can be reproduced.

joaquinlpereyra avatar Dec 06 '22 13:12 joaquinlpereyra