Poly Network hack
From Invertopedia, the encyclopedia of how things fail
Poly Network is a bridge that moves tokens between blockchains by locking them on one chain and unlocking them on another[2]. On August 10, 2021, an attacker sent a crafted cross-chain message that replaced the network's trusted signers, called keepers, with a key of its own, then unlocked tokens on Ethereum, Binance Smart Chain and Polygon that had never been locked anywhere[8][2][9]. The take was about $611 million[4], more than $610 million by the Guardian's count[3]. Within two weeks the attacker, whom Poly Network called "Mr. White Hat," had given back everything except $33 million in Tether that was frozen[3][5].
Contents
The bet
Poly Network trusted a small set of signers, the keepers, to vouch for messages from other chains[8][9]. On the destination chain, a contract called EthCrossChainManager ran whatever transaction a properly signed message contained, with no filter on what it could call[2].
That only works if nobody can change who the keepers are. Mudit Gupta's analysis notes that the design made it essential for EthCrossChainManager to have no special permissions users could exploit by speaking through it, and that it had exactly that: the permission to change the keepers[2].
What happened
| Aug 10, 2021 | The attacker routes a crafted transaction through Poly's relay and gets EthCrossChainManager to call the keeper-update function, replacing the four keepers with one key it controls.[8][9] |
|---|---|
| Aug 10, 2021 | With its own keeper in place, the attacker withdraws funds on Ethereum, Binance Smart Chain and Polygon. Poly tweets that it was attacked. Tether freezes about $33 million in USDT.[1][8][2] |
| Aug 11, 2021 | A day after the attack, the attacker starts sending funds back.[3] |
| Aug 12, 2021 | Poly Network says $342 million has been returned. The attacker, in notes on the Ethereum blockchain, says the point was to expose the flaw.[3][10] |
| Aug 13, 2021 | Poly Network confirms it offered a $500,000 "bug bounty" and calls the attacker a white hat. Most of the rest sits in a wallet controlled jointly by Poly and the attacker.[5][6] |
| Aug 23, 2021 | The attacker hands over the last private key. Poly Network says all user assets taken have been recovered.[5] |
| Jul 2, 2023 | Poly Network is attacked again. Tokens worth tens of billions of dollars on paper are minted across several chains, and the bridge is paused.[4] |
The kill shot
The contract that executed cross-chain messages also owned the list of trusted signers, and it would execute almost any message. So the attacker sent a message telling it to make the attacker the signer.
The owner of the EthCrossChainData contract, which stored the keepers, was the EthCrossChainManager contract, so the manager could change the keepers[8]. Because the manager executed data passed in by users, the attacker could pass in carefully built data that changed the keeper[8]. BlockSec found the attacker used a crafted function name whose signature hash collided with the keeper-update function, and that the Ontology relayer did not validate the transaction well enough to stop it[9].
SlowMist stressed that no keeper's private key had leaked[8]. Once the attacker's key was the keeper, it could build any transaction and withdraw any amount[8]. Nobody had to steal the keys: the system let the attacker change the locks.
Red flags ignored
- The messenger held admin rights. The contract that ran user messages also owned the keeper list.[8][2]
- No filter on messages. A cross-chain message could carry any transaction, not only a token unlock.[2]
- A relayer that waved it through. The Ontology relayer lacked the checks to reject the malicious transaction.[9]
- Four keepers, replaceable at once. One call swapped all four for a single attacker key.[9]
- The same team, two years later. In 2023 experts noted Poly had run a simple 3-of-4 multisig for two years and took seven hours to respond to the new attack.[4]
The cost
About $611 million left the bridge in 2021[4]. Poly Network got it all back except $33 million in Tether, which Tether had frozen[3][5]. The attacker had unlocked tokens on various chains without locking the corresponding amounts on other chains[2].
The second attack in July 2023 minted 57 tokens across 10 blockchains, with an on-paper value over $34 billion; thin liquidity meant the attacker could swap only about $10.1 million into ether[7]. Analysts alleged that keys for three of the four admin wallets had been compromised; Poly Network had not responded to the claim[7].
The inversion
Never let the component that carries messages hold the power to change who is trusted. Allow a cross-chain message to call only the exact functions it needs, and make any change to the signer set the hardest action in the system.
What survived
The money, this time. Poly Network said it regained control of $610 million, not counting the frozen $33 million[5]. It thanked the attacker for "helping us improve Poly Network's security"[6] and even offered a job as "chief security advisor"[5]. When the bounty was announced the attacker was still unidentified, and Chainalysis said the attack appeared to exploit a flaw in the contracts that move assets between chains[6].
After the second attack in July 2023, the team paused the bridge's operations[4].
References
- ^ “More Than $600 Million Stolen In Ethereum And Other Cryptocurrencies, Marking One Of Crypto's Biggest Hacks Ever”. Forbes, August 10, 2021 (Internet Archive copy). NEO as founder, the August 10 attack and Poly's tweet, and Tether freezing about $33 million.
- ^ “Poly Network Hack Analysis: Largest Crypto Hack”. Mudit Gupta's blog, August 2021. The date and chains, the lock-and-unlock design and unlocking without locking, no filtering of transactions, and the manager's permission to change keepers.
- ^ “'White hat' hacker behind $610m crypto heist returns most of money”. The Guardian, August 13, 2021. More than $610 million taken, all but $33 million in Tether moved to a joint wallet, returns starting a day after, and $342 million returned by August 12.
- ^ “Experts call the '$34 billion' attack the new Poly Network exploit”. ForkLog, July 3, 2023. The $611 million 2021 figure, the July 2, 2023 attack and pause, the 3-of-4 multisig used for two years, and the seven-hour response.
- ^ “Poly Network hacker returns remaining cryptocurrency”. CNBC, August 23, 2021. The jointly locked account, the chief security advisor offer, the final private key, full recovery, and $610 million regained excluding the frozen $33 million.
- ^ “Crypto platform Poly Network rewards hacker with $500,000 'bug bounty'”. Reuters, August 13, 2021 (Internet Archive copy). The $500,000 bounty, the white hat label and thanks, the jointly controlled wallet, and Chainalysis on the contract flaw.
- ^ “Attacker pockets $10 million from Poly Network security attack: Beosin”. The Block, July 3, 2023 (Internet Archive copy). The 2023 attack: 57 tokens on 10 chains, over $34 billion on paper, about $10.1 million swapped, and the alleged compromise of three of four admin keys.
- ^ “The Root Cause Of Poly Network Being Hacked”. SlowMist, August 10, 2021 (Internet Archive copy). EthCrossChainManager owning EthCrossChainData and able to change the keeper, user data passed through to change it, withdrawing any amount afterward, and no leaked keeper key.
- ^ “The Further Analysis of the Poly Network Attack”. BlockSec, August 11, 2021 (Internet Archive copy). The hash-collision function name, the weak Ontology relayer, and the four keepers replaced by one attacker key.
- ^ “Cryptocurrency heist hacker returns $260m in funds”. BBC News, August 12, 2021. The attacker's claim, in notes on the Ethereum blockchain, that the point was to expose the flaw.