According to a cybersecurity company that informed of the vulnerability on Sunday, the Ethereum proof-of-work blockchain experienced a replay exploit that allowed the attacker to get an additional 200 ETHW tokens by replaying a message from the proof-of-stake chain on ETHPoW.
BlockSec detects replay exploit with ETHPoW tokens
“The exploiter (0x82fae) first transferred 200 WETH through the Omni bridge of the Gnosis chain, and then replayed the same message on the PoW chain and got an extra 200 ETHW,” security company BlockSec said on Twitter. The attack happened because the bridge didn’t correctly verify the chain ID of the cross-chain message, the company claimed.
3/ The exploiter (0x82fae) first transferred 200 WETH through the omni bridge of the Gnosis chain, and then replayed the same message on the PoW chain and got extra 200 ETHW. As a result, the balance of the chain contract deployed on the PoW chain would be drained.
— BlockSec (@BlockSecTeam) September 18, 2022
According to the ETHPoW blockchain development team, an assault targeted the bridge’s contract vulnerability rather than its blockchain directly.
“ETHW itself has enforced EIP-155, and there is no replay attack from ETHPoS and to ETHPoS, which ETHW Core’s security engineers have planned in advance,” the ETHW Core developers wrote in a Medium post.
The developer team also said that it had been trying to get in contact with Omni Bridge since Saturday to inform them of the risks. Omni Bridge did not immediately respond to a request for comment.
“We have contacted the bridge in every way and informed them of the risks,” it said. “Bridges need to correctly verify the actual ChainID of the cross-chain messages,” they said.
The ETHPoW fork on the proof-of-work Ethereum blockchain went live this week after The Merge. The token has fallen over 35% following the news of the exploit Sunday morning, according to data from TradingView.
Read more: