BlockSec: Taiko suspected of being attacked due to GitHub leak of SGX attestation key, resulting in losses exceeding $1.7 million

BlockBeats News, June 22 — According to BlockSec monitoring, the Taiko network was attacked, resulting in losses of over $1.7 million. Preliminary investigations suggest that the possible root cause is the exposure of the Raiko SGX enclave signing key on GitHub. Raiko is Taiko’s multi-prover stack used for Taiko and Ethereum blocks, so the exposed Raiko SGX enclave key could directly impact Taiko’s on-chain proof verification process.

Because the enclave signing key is publicly accessible, the trust model of SGX provers may have been compromised. The exposed key could allow attackers to register SGX instances controlled by them. Once registered, these instances can sign proof inputs accepted by Taiko’s proof verifiers, enabling fraudulent state/signaling proofs to pass. The attacker can then use forged source signals to register fake bridge messages as RETRIABLE, and subsequently call retryMessage to cause the ERC20Vault to release the standard L1 assets.