Analysis of the Poly Network Hacker Attack Incident

Recently, the cross-chain interoperability protocol Poly Network was attacked by a Hacker, drawing widespread attention. After in-depth analysis by the security team, it was found that the attacker did not implement the attack through the leakage of the keeper's private key, but instead exploited a vulnerability in the contract.

Attack Principles

The core of the attack lies in the EthCrossChainManager contract's verifyHeaderAndExecuteTx function, which can execute specific cross-chain transactions through the _executeCrossChainTx function. Since the owner of the EthCrossChainData contract is the EthCrossChainManager contract, the latter can call the former's putCurEpochConPubKeyBytes function to modify the contract's keeper.

The attacker passed carefully crafted data to the verifyHeaderAndExecuteTx function, causing the _executeCrossChainTx function to call the putCurEpochConPubKeyBytes function of the EthCrossChainData contract, thereby changing the keeper role to an address specified by the attacker. After the keeper role replacement is completed, the attacker can arbitrarily construct transactions and withdraw any amount of funds from the contract.

Attack Process

1. The attacker first called the putCurEpochConPubKeyBytes function through the verifyHeaderAndExecuteTx function of the EthCrossChainManager contract to change the keeper.

2. Subsequently, the attacker leveraged the modified permissions to carry out a series of attack transactions, extracting funds from the contract.

3. Due to the modification of the keeper, the normal transactions of other users were rejected.

4. This attack pattern has occurred not only on the BSC chain but also on the Ethereum network, which has encountered similar attacks.

Conclusion

The fundamental cause of this attack incident lies in the fact that the keeper of the EthCrossChainData contract can be modified by the EthCrossChainManager contract, and the verifyHeaderAndExecuteTx function of the EthCrossChainManager contract can execute user-input data through the _executeCrossChainTx function. The attacker exploited this design flaw by constructing specific data to modify the keeper of the EthCrossChainData contract, thereby achieving fund theft.

This event once again highlights the importance of security design in cross-chain protocols, especially the need for stricter audits and restrictions in permission management and function calls. For decentralized finance projects, continuous security audits and vulnerability fixes are crucial to prevent similar attack incidents.