PANews July 21日消息, according to BlockSec monitoring, Wanchain’s Cardano cross-chain bridge was attacked, and approximately 515 million NIGHT tokens were stolen from the bridge’s vault. Initial investigation shows the root cause lies in an encoding issue of non-injective signature message data in the TreasuryCheck verifier. The signature message is constructed by concatenating 14 redeem fields of variable length (folded using AppendByteString) without any delimiters or length prefixes, causing different combinations of field values to produce the same byte string—thereby reusing the same hash and a valid signature. BlockSec confirmed the vulnerability by decompiling the on-chain Plutus V2 bytecode and decoding the redeem data from the attack transaction for verification. If Sha3_256(SerialiseData(...)) is used instead, it can provide clear CBOR encoding field boundaries and thus prevent this kind of field-splitting signature reuse attack.
PANews July 21日消息, according to BlockSec monitoring, Wanchain's Cardano cross-chain bridge was attacked, and about 515 million NIGHT tokens were stolen from the cross-chain bridge treasury vault. Preliminary investigation indicates the root cause was an issue with the non-injective signature message encoding in the TreasuryCheck verifier. The signature message was constructed by concatenating 14 variable-length redemption fields (folded using AppendByteString), without any separators or length prefixes, which allowed different combinations of field values to produce the same byte string—thereby reusing the same hash and a valid signature. BlockSec verified the vulnerability by decompiling the on-chain Plutus V2 bytecode and decoding the redemption data of the attack transaction. If Sha3_256(SerialiseData(...)) is used instead, providing clear CBOR-encoded field boundaries, this kind of field-splitting signature reuse attack can be prevented.
$ADA resistance has reached; if you want to unwind, run away quickly! Otherwise if it kills down to 0.08, your legs will go numb and you won’t be able to run.
$ADA I said don't listen to that kind of advice, hahaha Spending over 100 every month—I already think it's expensive myself Smash these greedy longsters
$ADA There are still about 10M long positions stubbornly holding on, and it’s estimated they’ll have to drop another 10% before things stabilize Longs, get ready to blow up!
$XRP This coin ultimately drops back to 0.84 just like ADA. Then it rallies again after accumulating more shares. Now, anyone buying above 1U is almost all bagholders chasing the spike.
$ADA Really hilarious—some D keeps promoting the cold wallet link again. They act like they’re so high and mighty. Not pushing exchange links and stuff—yet what they do is basically the same. Heh. Keep falling. Keep scamming If these people don’t cut their losses and leave the market, then for it to go up—well, that’s hard to say.