Analysis of the abnormal transfer event of large transaction fees on the Ethereum network for three consecutive days
Recently, there have been three transfers of abnormally large transaction fees on the Ethereum network within 3 days.
According to the data on the chain, the most recent transaction with a large transaction fee was to send 3,221 ETHs from an address labeled MiningPoolHub to an address starting with 0xe38. The transaction fee for this transaction was as high as 2,310 ETH (approximately $540,000). According to the data on the chain, the block containing this abnormal fee transaction was packaged and generated by F2Pool. The details of the transaction are shown in the figure below:
According to the alarm information of the Chengdu Lianan Threat Intelligence System, this is the third transaction with an abnormally large transaction fee in the near future.
For these unusually large transaction transactions, after the analysis team of Chengdu Lianan Security Lab used the company’s leading product Beosin-AML (anti-money laundering and investigation and evidence collection system) to analyze, the initiator of the third 2310ETH transaction fee was Mining The mining address of Pool Hub, the address set a Gas Price of up to 0.11Ether (110000000Gwei) in a transaction today (2020.6.12) to clear the address balance. The address starting with 0xe386e, the remaining up to 2310Ether (0.11 Gas Price multiplied by the 21000 gas used) is paid to the F2Pool address of the packaged transaction as the transaction fee.
The transaction fee of this transaction is more likely to be abnormal, but the wallet balance is emptied at one time, so that there is no balance to be used for Gas consumption, which does not conform to the attack logic of "threat", so we think it is different from the previous one. There may be no direct connection between the two suspected abnormal transactions targeting exchanges. From the transaction data on the chain, it can be seen that the address has resumed normal use at present, so it can be known that the security of its private key should not be threatened, and there are no further abnormal transactions at this address.
According to our experience of multiple wallet audits, the transaction anomaly may be mainly caused by the attacker hijacking the transaction to set the Gas Price by some means. Before the transaction is signed, the Gas Price is directly set to an abnormal value, thereby generating a legitimate Unusual transaction.
In addition, it is worth mentioning that before this, there were two transactions with abnormally large transaction fees within two days from June 10. The first transaction occurred at 17:47 on June 10. At the height of 10237208, there was a transaction fee as high as 10668.73185 ETH. The address starting with 0xcdd6a2b transferred 0.55 ETH to the address starting with 0x12d8012. The package mining pool for this transfer It is Spark Mining Pool. The transaction situation is shown in the figure below:
The second transaction occurred at 3:30 am on June 11, and the transaction fee was as high as 10668.7ETH, which was also sent from the address starting with 0xcdd6a2b. The transaction details are shown in the figure below:
Transaction fee anomalies have always occurred on Ethereum, and it is not a new problem. However, according to our continuous tracking and analysis of transaction fees on the chain, the most common cause of such incidents is often unsafe factors such as wrong fee units or digits in manually constructed transactions. The reason why this incident has received more attention is mainly because it involves suspected exchange addresses. Exchanges generally have a highly automated and specialized control over transaction fees for users to perform transactions such as withdrawals. On this basis, we believe that exchanges are generally less likely to make these "low-level mistakes".
For exchanges, how to avoid such incidents? According to our experience in the service security architecture of the exchange, when the exchange deploys its own hot and cold wallet services, it must separate the business and data from the main service of the exchange, and increase the number of operations such as withdrawal and recharge. Certain review mechanism. For business security, it is necessary to deploy a corresponding business security risk control system to increase system and business security.
