クリプトドットイン

暗号に強い人材のためのオルタナティブ・リンクトイン

Ethereum Layer 2 Platform Abstract Reports $400K Crypto Breach in Cardex Incident

-

によって

クリプトドットイン
で

Ethereum Layer 2 platform, Abstract, has released an initial post-mortem on a security incident that resulted in the compromise of approximately $400,000 worth of ETH across 9,000 wallets interacting with Cardex, a blockchain-based game on its network.

The report clarified that the breach stemmed from vulnerabilities in Cardex’s frontend code rather than an issue with Abstract’s core infrastructure or session key validation contracts.

Cardex Wallet Compromise

The incident revolved around the misuse of session keys, a mechanism in the Abstract Global Wallet (AGW) that allows for temporary, scoped permissions to improve user experience.

While session keys themselves are a well-audited security feature, Cardex made a critical error by using a shared session signer wallet for all users, a practice that is not recommended. This flaw was further amplified by the exposure of the session signer’s private key to Cardex’s frontend code, which ultimately led to the exploit.

According to Abstract’s root cause analysis, attackers identified an open session from a victim, initiated a buyShares transaction on their behalf, and then used the compromised session key to transfer the shares to themselves before selling them on the Cardex bonding curve to extract ETH.

Importantly, only the ETH used within Cardex was affected. Meanwhile, users’ ERC-20 tokens and NFTs remained secure due to session key permissions limitations.

The timeline of events indicates that the first signs of suspicious activity were flagged at 6:07 AM EST on February 18th when a developer posted a transaction link showing an address draining funds. In less than 30 minutes, Cardex was suspected as the source of the exploit, and security teams quickly mobilized to investigate.

Within hours, mitigation steps were taken. This included blocking access to Cardex, deploying a session revocation site, as well as upgrading the affected contract to prevent further transactions.

Abstract has outlined several measures to prevent future incidents of this nature. Going forward, all applications listed in its portal must undergo a stricter security review, including front-end code audits to prevent the exposure of sensitive keys. Additionally, session key usage across listed apps will be reassessed to ensure proper scoping and storage practices. Documentation on session key implementation will be updated to reinforce best practices.

What’s Ahead

In response to this breach, Abstract is also integrating Blockaid’s transaction simulation tools into AGW, which will help users to see what permissions they are granting when creating session keys. Further collaborations with Privy and Blockaid are underway to improve session key security.

A session key dashboard will also be introduced in The Portal, which is expected to give users a centralized interface to review and revoke their open sessions.

ポスト Ethereum Layer 2 Platform Abstract Reports $400K Crypto Breach in Cardex Incident に初登場した。 クリプトポテト.

コメント

コメントを残す

メールアドレスが公開されることはありません。 ※ が付いている欄は必須項目です

最新フィード

人気カテゴリー

ja 日本語
ja 日本語 en_US English ro_RO Română et Eesti ko_KR 한국어 ru_RU Русский de_DE Deutsch es_ES Español zh_CN 简体中文 fr_FR Français zh_TW 繁體中文 pt_PT Português it_IT Italiano pl_PL Polski tr_TR Türkçe nl_NL Nederlands id_ID Bahasa Indonesia el Ελληνικά uk Українська bg_BG Български cs_CZ Čeština fi Suomi hu_HU Magyar lv Latviešu valoda lt_LT Lietuvių kalba nb_NO Norsk bokmål sk_SK Slovenčina sl_SI Slovenščina sv_SE Svenska

ウェブサイトを検索

人気記事

タグ

#AlexeyPertsev (1) #Bidenクリプトバン (1) #Biden選挙 (1) #BinanceVsCoinbase (1) #ビットコイン (458) #BitcoinETF (3) #ビットコイン基礎知識 (1) #ビットコインの取り扱い (1) #Bビットコイン価格 (5) #BitcoinPriceLevel (1) #BitcoinPump (1) #BitcoinReserve (1) #ビットコイン・サージ (1) #Bitcoinトップ (1) #Bitfinex (1) #ビットワイズ (1) #BracebridgeCapital (1) #BRC20トークン (1) #BTC取得 (1) #Bullish予測 (1) #Bullishセンチメント (1) #中国鉱業 (1) #CPプレビュー (1) #CryptoAsset (2) #CryptoBattle (1) #CryptoBoom (1) #CryptoExpert (1) #CryptoInsights (1) #クリプトマニア (1) #CryptoMarket (4) #CryptoPrediction (1) #Crypto予測 (1) 1TP5トリプトレギュレーション (2) #CryptoTakeoff (1) #CryptoTiming (1) #CryptoTips (1) #CryptoTreasury (1) #CryptoUncertainty（暗号の不確実性 (1) #Dデリバティブジャンプ (1) #Dogecoin (74) #Dogecoinゲイン (1) #Dogecoinボリューム (1) #ダッチコート (2) #ECコマース (1) #ElSalvadorビットコイン (1) #Ethereum (74) #EthereumPain (1) #EthereumPrice (1) 1TP5専門家の意見 (1) #Fedレートカット (1) #FiatCurrency (1) #フィナンシャル・インパクト (1) #フィナンシャル・プライバシー (1) #Firmシャットダウン (1) #F凍結アカウント (1) 1TP5自己資金 (1) #InflationData (1) 1TP5投資 (1) 1TP5投資損失 (1) #日本ファーム (1) #法的措置 (1) 1TP5法的影響 (1) #法律 (1) #LightningNetwork (1) #市場分析 (3) #Mマーケットモニタリング (1) #M市場予測 (1) #市場予測 (1) #M市場予測 (1) #Mマーケットサポート (1) #マーケットボラティリティ (1) #マリッジ (1) #MemeCoin (5) #Memeコイン (2) #Miner収益性 (1) #マネーロンダリング (2) #MtGox (4) #北朝鮮暗号 (1) #ノボグラッツ予想 (1) #Priceマイルストーン (1) #P価格予測 (2) #Price質問 (1) #プライスサージ (1) #Prisonセンテンス (1) #QuantAnalysis (1) 1TP5規制圧力 (1) #SECアンチクリプト (1) #ShibaInu (6) #SocialBuzz (1) #技術分析 (1) #トンコイン (3) #トルネードキャッシュ (3) #TornadoCashDev (1) #TornadoCashデベロッパー (1) #UKクリプト (1) #Upsideポテンシャル (1) #USCongress（米国議会 (1) #ワイオミングランド (1) #XRP価格 (1) #XRPupswing (1)

お役立ちリンク

私が役に立ち、共有したいと思ったリンク