Skip to main content

Security firm discovers $500M vulnerability in Tron multisig accounts

After reporting the vulnerability to Tron in February, the researchers highlighted that the issue was promptly addressed and resolved within a few days.

A research team at dWallet Labs has discovered a zero-day vulnerability in Tron multisig accounts, allowing an attacker to bypass the multisignature mechanism and sign transactions with a single signature.

In a technical breakdown post, the research team said the vulnerability could have impacted $500 million in assets held in Tron multisig accounts. This is because it allows any signer to “completely overcome the multisig security offered by TRON.”

As its name suggests, multisignature wallets require multiple signers defined in an account to approve transactions and move funds, allowing the creation of joint accounts in crypto. Each account signer holds their own keys and the account requires a certain threshold for approving transactions. 

According to the research team, the vulnerability with Tron’s multisig allows for generating many valid signatures. They wrote:

“We can bypass the multisig verification process by signing the same message with non-deterministic nonces of our choice. By doing so, we will be able to generate many valid different signatures for the same message by the same private key.”

According to the cybersecurity team, Tron ensures the signatures are unique instead of checking if the signers are unique. Because of this, signers can potentially “double vote” or sign twice. Omer Sadika, the CEO of dWallet Labs, said the fix was simple: verify the address instead of the number of signatures.

Sadika discussed the vulnerability in a thread. Source: Twitter

The researchers noted that the vulnerability was reported to Tron in February and fixed days after.

Related: Justin Sun issues apology after Sui LaunchPool clashes with Binance CEO

Cointelegraph reached out to Tron for comments but did not receive a response.

In other news, another decentralized finance protocol recently suffered a $7.5 million exploit. On May 28, blockchain security firm PeckShield reported that Arbitrum-based Jimbos Protocol was hacked, resulting in the loss of 4,000 Ether (ETH).

Magazine: US and China try to crush Binance, SBF’s $40M bribe claim

Comments

Post a Comment

Popular posts from this blog

STX Hits 52-Week High! Ascending Channel Points to Bullish Trajectory

Image
Stacks (STX) soars 8.74% in 24 hours, hitting a 52-week high at $2.06, riding the crypto wave. STX’s rise is attributed to Bitcoin optimism and its role as a layer 2 solution. Technical analysis points to a bullish trend, aiming for $2.6, but watch out for potential corrections at $1.6. Stacks (STX) has continued its upward trajectory, with its price recently reaching a 52-week high of $2.06, marking an 8.74% increase in just 24 hours. This surge is part of a broader trend that has seen the cryptocurrency gain 749% over the past year. Market analysts attribute this impressive performance partly to the growing optimism surrounding the potential approval of a spot Bitcoin ETF, which could further galvanize the cryptocurrency sector. STX/USD 24-hour price chart (source: CoinStats ) During the bull rally, STX’s market capitalization and 24-hour trading volume surged 9.45% and 24.95%, to $2,852,664,529 and $715,025,179, respectively.  Stacks as a...
Read more

XAI tanks by 20% after airdrop and Binance listing

Image
The layer-3 gaming token fell by more than 20% after an airdrop and Binance listing on Jan. 9. According to CoinGecko, the layer-3 gaming token Xai has fallen by more than 22% in 24 hour trading. The current price of the token is $0.5231. X rate fell sharply just a day after reaching an all-time high on Jan. 9, in which the price of the coin was $0.7734. Source: CoinGecko The token price collapse occurred shortly after Xai held its first major gaming token airdrop in 2024. According to the Xai Foundation, it offered 125 million XAI tokens (or 5% of the total token supply) to eligible users, including holders of certain Xai NFTs and those operating gatekeeper nodes or validators that help support the network. Dear Xai Community, As we approach the XAI token claim, it's crucial to stay vigilant against potential scams. Please carefully read and follow these guidelines: Official Contract CLAIM Address: The ONLY legitimate $XAI airdrop claim contract address is… — XA...
Read more

Bitcoin Price Prediction: MicroStrategy Boosts BTC Ownership To 1% Of Supply As This Eco-Friendly Alternative Soars Towards $7 Million

Image
The Bitcoin price gained slightly in the last 24 hours to trade at $63,857.08 as of 9:05 a.m. EST as investors tentatively accumulate the crypto. During BTC’s 12% correction over the past 7 days, MicroStrategy bought another 9,245 bitcoins for $623 million in cash between Mar. 11 and Mar. 18, according to a Mar. 19 statement . Following this latest purchase, the company’s total BTC holdings stand at 214,246 BTC, which is more than 1% of the crypto’s total supply of 21 million coins. The Bitcoin Price Bounces Off Of A Key Support 4-hour chart for BTC/USDT (Source: TradingView ) The Bitcoin price rebounded off of the $61,481.65 support level in the last 12 hours. Should bulls continue to push the market leader’s price higher, it may attempt to reclaim a position above $65,847.29 in the coming 48 hours. A 4-hour candle close higher than this significant price point could then give BTC the foundation needed to keep climbing. In this more bullish scenario, th...
Read more