Lido assures LDO, stETH tokens remain safe despite flaw in token contract

Related articles

Ethereum staking protocol Lido Finance has assured each Lido DAO (LDO) and staked-Ether (stETH) tokens stay secure regardless of hackers allegedly exploiting a recognized safety flaw in LDO’s token contract.

Lido didn’t confirm any exploits, however acknowledged the safety flaw was recognized and reassured LDO and stETH funds remain safe in response to a Sept. 10 submit by blockchain safety agency SlowMist.

SlowMist stated LDO’s flawed token contract permits unhealthy actors to facilitate “pretend deposit” assaults on exchanges as a result of LDO’s token contract allows customers to execute transactions even the place they don’t have adequate funds. This code deviates from the Ethereum Request for Comment 20 (ERC-20) token normal, in line with SlowMist.

Nevertheless, Lido Finance argued the flaw is constructed into all ERC-20 tokens — not simply Lido’s LDO token:

SlowMist stated the “pretend deposit” assaults got here from LDO’s token contract executing transfers the place the worth is bigger than what the consumer truly owns, triggering a false return versus reverting the transaction. Whereas the agency stated Lido’s token contract has not too long ago been exploited by way of this assault, no on-chain proof was supplied.

Cointelegraph reached out to SlowMist for remark however didn’t obtain a direct response.

In the meantime, on-chain analyst “Hercules” explained on Sept. 10 that the safety flaw is probably not picked up by cryptocurrency exchanges.

SlowMist recommends LDO holders to additionally examine the return values of the token contract transfers along with the success or failure of a transaction.

The blockchain safety agency concluded that token contract implementations and behaviors range by mission and to conduct complete testing earlier than integrating any new tokens.

Associated: Ethereum staking services agree to 22% limit of all validators

Nevertheless, Lido highlighted within the official Ethereum Improvement Proposal document — co-authored by Vitalik Buterin in November 2015 — that each the “switch” and “transferFrom” features should return the switch standing and are solely really helpful to revert a transaction in distinctive circumstances.

To resolve the safety flaw, Lido confirmed the LDO token integration guides will quickly be up to date.

Journal: DeFi Dad, Hall of Flame: Ethereum is ‘woefully undervalued’ but growing more powerful