Written by Trustless Labs
After an in-depth study of the BRC-20 code and mechanism, we found that there are possible attacks against huge holders during the transfer stage. In order to help exchanges check whether there are process specification issues and practice the white hat spirit, we tried to use tested methods to lock Binance ORDI hot wallet assets, causing Binance to suspend ORDI withdrawals. We immediately notified the Binance team and communicated the details of the operation to help Binance resume withdrawals as soon as possible. Three hours later, Binance resumed ORDI withdrawals. This article will start from the design principles of BRC-20 and systematically analyze the reasons why Binance suspended ORDI withdrawals to help everyone understand why anyone can lock your BRC-20 balance.
First, let’s take a look at what is happening on the chain on UniSat.
This is the balance of Binance ORDI hot wallet displayed on UniSat at the time of writing this article, which is divided into three parts: Transferable, Available, and Balance. This involves three basic concepts in BRC-20: Transferable balance, Available balance, and Overall balance. Transferable balance refers to the balance that can be transferred directly, Available balance refers to the balance that can be converted into Transferable balance, and Overall balance is the sum of the previous two, indicating the total balance of the current address. Seeing this, you may ask, since the current Binance ORDI hot wallet has so much balance, why can't it be withdrawn? Don't worry, let's continue reading.
The transfer of BRC-20 requires two steps. The first step is to inscribe a transfer Inscription, and the second step is to transfer this Inscription to the recipient to complete the BRC-20 transfer. Since the Inscription transfer is based on UTXO, that is, the number of amt of Inscription inscribed in the first step determines the number of amt of BRC-20 that can be transferred in the second step, so the Transferable balance mentioned above is also based on UTXO. For the sake of understanding, let's take an example. Suppose A is a newly created address, and then you mint m ORDI to address A, or transfer m ORDI from other addresses to address A. At this time, the Available balance and Overall balance of address A are both m, and the Transferable balance is 0. Then we transfer n ORDIs from address A to address B. The first step is to inscribe an Inscription with amt n to address A (the Inscription is valid if and only if n <= m). At this time, the Transferable balance of address A is n, the Available balance is m - n, and the Overall balance is m. The second step is to transfer this Inscription with amt n to address B. At this time, the Available balance and Overall balance of address A are both m - n, and the Transferable balance is 0. The Available balance and Overall balance of address B are both n, and the Transferable balance is 0. The transfer is completed.
Take the Binance ORDI hot wallet transaction list displayed on UniSat as an example. In the figure, the method inscribe-transfer corresponds to the first step mentioned above, and the method receive or send corresponds to the second step. In addition, the last two transactions in the figure together constitute a complete BRC-20 transfer. The other three inscribe-transfer transactions inscribe three Inscriptions with amt of 8,210,108, 6,099, and 2,683 respectively, and these three Inscriptions together constitute the Transferable balance. Therefore, if you want to transfer ORDI from the Binance ORDI hot wallet now, you can only transfer three ORDIs corresponding to amt, which of course cannot meet the diverse withdrawal needs of users.
The reason for this is that anyone can inscribe an arbitrary Inscription to any address, so anyone can lock the BRC-20 balance of any address by executing the first step of the BRC-20 transfer. So how should Binance solve the current problem? In fact, it is very simple. As long as the three Inscriptions mentioned above are transferred to yourself, the Transferable balance can be changed back to the Available balance, and then the Inscription corresponding to the AMT can be inscribed and transferred out according to the user's withdrawal needs. However, this can only solve the problem immediately, and cannot fundamentally solve the problem. Only by improving the protocol itself and solving the current defects in the BRC-20 design can the problem be solved once and for all.
