登録して招待リンクを共有すると、動画再生報酬と紹介報酬を獲得できます。

SlowMist
@SlowMist_Team
SlowMist is a Blockchain security firm established in 2018, providing services such as security audits, security consultants, red teaming, and more.
参加 April 2018
410 フォロー中    88.7K ファン
🚨SlowMist TI Alert🚨 💸 Loss: 14.411518807585587 ETH 🔍 Root Cause: Storage slot collision between `ATOHook.rewards` mapping slot and Solady `ReentrancyGuard` fixed slot (`0x02215292eb9609279094554c6e223f800950648ddfa3da30329838d6c170928d`). The `nonReentrant` modifier in `getReward()` writes sentinel value `0xffffffffffffff` to the guard slot, which is simultaneously read as `rewards[attackContract]` due to the collision. This inflated reward is paid as ETH each call, allowing 200 repeated claims. 📌 Attacker (EOA): 0x2d2aafc193c24e59bd16139056ac9b4df4d37ad0 📌 Victim Contract: 0xa10de71ddb4e0d51938ef6e0118822e157a62888 📌 Attack Contract: 0x2441e480f62bf609a08da09143e4baf8a817d757 Storage collision between reward accounting and reentrancy guard enables unlimited reward drainage. Powered by #SlowMist#.AI
もっと見る