Binance Smart Chain multi-project run away, PopcornSwap swept away 40,000 BNB, why is the exchange's public chain "embarrassing"?
Wu said the author | Colin Wu
Editor of this issue | Colin Wu
Wu said the author | Colin Wu
Editor of this issue | Colin Wu
Recently, a number of liquid "miners" told Wu Shuo Blockchain that another DeFi "earth mine" popcornswap on the Binance Smart Chain has run away, and the project has approached 48,000 BNB, worth about 2.15 million US dollars. Three more projects (Zap Finance and Tin Finance, SharkYield) ran away within a few days. At present, SharkYield seems to have taken away 6,000 BNB by running away.
Binance stated that the security team was "following up" the popcornswap project overnight, but it may not be able to recover successfully. Binance’s previous promotional articles also stated that recovery is a low-probability event, and users are expected to invest carefully and choose high-quality leading projects to participate.
There are two problems in this popcornswap runaway event:
1. Feedback from miners, Binance stated that USDT (through Tether) and BUSD can be frozen, but BNB cannot be frozen, so the running project began to use BNB on a large scale.
2. Binance once stated that in the future, the Binance Smart Chain community will provide audit services for the deployed high-quality projects one after another. In the future, there will be signs to distinguish audited and unaudited projects for user reference. But until now, the audit mark has not appeared, which may be hindered by the high cost and time of the audit agency.
Binance’s previous feedback was that BSC is the same public chain as Ethereum and should not be responsible for the above projects. He Yi once said: The Binance Smart Chain project was not developed by Binance, so why not ask V God to claim compensation for losing money in mining on Ethereum?
But on the other hand, Binance is promoting to help users recover their assets. For example, Wine Swap, an "earth mining" project of an automatic market maker (AMM), ran away, and the Binance security team helped users recover 99.9% of the lost funds, totaling more than 344,000 US dollars. Binance also stated that such a pursuit often requires a lot of manpower and material resources, and often the clues of these pursuits will be interrupted. It can be said that it is rare to be successful in this pursuit.
As a result, Binance will fall into an embarrassing situation: should it manage or ignore the running projects? Users will also have questions about this, does Binance care about it?
The logic of the project on BSC is that CZ, a well-developed project, will retweet, and then attract attention and gradually grow. In contrast, the Huobi ecological chain has a higher degree of centralization, and registration projects will be listed, and there are fewer cases of running away. Binance Smart Chain hopes to "not be a referee".
Because Huobi’s projects and users are mostly Chinese, this also determines that they must choose centralized management and control. It is said that Huobi has detailed emergency plans for running projects, and several small projects have been dealt with immediately.
refer to
The Ambition and Embarrassment of Binance Smart Chain (BSC): Beyond Ethereum or Become Sun Yuchen?
The following content is the exclusive authorization of iNexusPro to release the Wu Shuo blockchain, and the content is slightly edited
Generally speaking, there are several steps to withdraw funds from earth mines:
1. Use high APY to attract your impulsive stud (note that many thieves’ soil mines are written in APR, which looks higher, and you can directly close it if you use APR’s soil mines to seek stability), after all, high APY is supported by real gold and silver , The big players with such high returns came early, as the saying goes, the higher the returns, the greater the risks.
2. Through some "so-called" security measures (timelock, etc.) to make you feel that the risk is very low.
3. Immediately after stealing funds, exchange them for non-erc tokens or tokens that cannot be frozen, and then wait for the opportunity to mix coins to escape.
After seeing this step, you should understand, if you can:
1. No open source soil mines will be touched, no matter how attractive his APY is written
2. If you want to participate in an open source soil mine, you must participate with a small amount of funds after checking the variable parameters in the diff contract. (However, there may be risks, such as popcornswap, which will be explained in detail)
3. I believe you can avoid most of the risks. Let me briefly talk about how to diff contracts, how to check parameters, and some derivative thinking.
The first step: diff
Here take the online comparison tool https://www.diffchecker.com/ as an example
https://bscscan.com/address/0x73feaa1ee314f8c655e354234017be2193c9e24e#code
Note that the diff contract needs to be the contract address you actually want to transfer coins into (you can transfer a very small amount to get the address)
https://bscscan.com/address/0x584527ded17aceb3dc617c40b04e8fe9afc57096#code
First get the original MasterChef code (here we take pancakeswap as an example):
Then here is an example of popcornswap:
Copy the code to both sides separately and start diff
Here I saved the diff results, you can directly click this link: https://www.diffchecker.com/VqaCP3DK
Modifications such as strings (names, etc.) in the result, or content after // (comments) can be ignored
As shown above, it can be ignored
If it is the code added by the original version, it is generally not important that the soil dog deletes it. The key point is that the code of the soil dog is different from the original version:
The above picture shows the key difference. Tugou modified the original migrator method and added a function called preUpgrade.
Seeing this, if you don't know anything about the contract, you can close the page directly to keep safe during the security period.
Here is a brief analysis of the differences. First, the migrate method. This is the code inherited from sushiswap. The original code has the possibility of emptying the money in the pool (so if Tugou has the migrate method, don’t play it for stability).
Here in popcorn, the new preUpgrade method is public, which means that everyone can call it.
Step Two: Check the Variables
Click this button of the Tugou contract:
Check migrator, owner and other variables: (owner is the core)
It can be seen that the migrator is 0, and the owner is a timelock address. One of the tricks of Tugou is to claim that it has a timelock and give the contract address, but the owner is not the address of the timelock, which is obviously a scam.
Of course, the timelock contract can also do small actions, so it also needs to do diff operations. There is no problem with his timelock here, so I won’t go into details.
https://bscscan.com/tx/0x38f75296e3343228c0309f8c99a24ca4f4812372f2b032f38ce25ac5a992b768
After completing the above two steps, many senior miners may feel that there is a timelock, and the contract variables are no problem. Although there are risks in the code, but there is a timelock, it’s okay, rushing to tmd, for low-level local dogs, it may indeed be useless. It's risky, but unfortunately, popcornswap is a slightly advanced dog. See me break down the stealing process below:
The project party calls:
The preUpgrade method allows your address to have the transferFrom permission of the token in the contract (simple understanding means that you need to allow the contract to spend your coins before the uniswap transaction, here is allow yourself to spend the coins in the contract)
Looking at the previous code, you can find that preUpgrade does have this function, but it only gives the migrator this permission, and the migrator is 0. Modifying the migrator requires a time lock, so how does it do it? (This question actually bothered me for a while)
The answer is: after deploying the contract and before adding the timelock, the project party changed the migrator to its own address, and obtained the allowance of all the tokens in it through preUpgrade in advance, and then changed back to the migrator to add a timelock.
Because these tx are mixed with the tx added to the pool by the project side, it is impossible for ordinary people to check every tx before a pool, so popcornswap was able to steal 2mil tokens within 2 hours.
This modus operandi has also aroused my thinking. At present, there is no effective tool that can detect the token allow to other addresses in a contract address, so it is very difficult to find the problem. Ordinary users have no ability and are unlikely to discover this clue. Even I believe that in this incident, some old earth mining drivers who understand the contract code also overturned.
follow-up thoughts
After the exposure of this modus operandi, I believe that future earth mines are likely to use similar methods to steal coins, but it is impossible for ordinary users to guard against it. In fact, there have been 2 mines overturned on bsc in the past 2 days, and the amount is not high. Small.
As an exchange public chain, whether it is bsc or heco, what is their core competitiveness? Is it decentralized?
I personally don't think so.
bsc, heco, etc., their biggest advantages should be 1. Low handling fee 2. Endorsement of the credibility of the exchange.
