GoPlus: Recently, EIP-7702 has triggered multiple contract attacks, and it is recommended that the project party strengthen measures for flash loan attack protection and other measures.

PANews, July 9 news, according to security agency GoPlus, multiple recent contract attack cases have exploited EIP-7702 features to bypass on-chain security checks, including msg.sender == tx.origin and msg.sender == owner, leading to flash loan attacks and price manipulation issues, with losses reaching nearly one million dollars. Case analysis shows that attackers implemented attacks through malicious delegator authorization, affecting well-known DeFi projects including QuickConverter @QuickswapDEX and several CSM liquidity pools.
The implementation of EIP-7702 gives EOA addresses smart contract capabilities, rendering traditional security logic ineffective. GoPlus recommends that project teams enhance protection against flash loan attacks and reentrancy attacks, restructure EOA verification and permission management logic, and continuously monitor the delegator authorization status of administrator addresses to prevent potential risks.
Disclaimer: The information on this page may come from third-party sources and is for reference only. It does not represent the views or opinions of Gate and does not constitute any financial, investment, or legal advice. Virtual asset trading involves high risk. Please do not rely solely on the information on this page when making decisions. For details, see the Disclaimer.
Comment
0/400
No comments