The Wintermute has been exploited for more than 160M loss. The root cause is that the private key of the Wintermute project was compromised possibly due to a vulnerability in the Profanity tool, which was used by Wintermute to generate the private key and the Ethereum account.
In this blog, we will describe the root cause of the vulnerability in Profanity and how the vulnerability can be exploited.
The Ethereum address
The Ethereum address is generated from the Keccak-256 hash of the public key and is represented as hexadecimal numbers. The public key is generated from the private key using elliptic curve multiplication, which is irreversible. We can get a public key from a private key. However, we cannot get the private key given a public key, without brute force. Note that the length of the private key is 256 bits. Given a public key, you need at most 2^256 calculation to find the corresponding private key.
In a word, the relationship between the private/public key and the Ethereum address is shown in the following figure.
The root cause of the vulnerability
The purpose of Profanity is to find a special Ethereum address, e.g., the five leading numbers of the address are zero. For this purpose, Profanity takes the following method.
The detailed implementation may be slightly different.
Note that the length of private_key is 256 bits (2^256 different values). However, there is a vulnerability in generating the private key. Specifically, the seed (in step 1) is only 32 bits, and the process from the seed in step 1 to the private_key in step 2 is deterministic.
What’s the security impact here?
How to exploit
Let’s say we have an Ethereum address with many valuable assets. If we can get its private key, then we can own this account and transfer all the assets out. However, as previously discussed, we must brute force the whole 2^256 space to find the private key, which is nearly impossible.
But what if the Ethereum address is generated from the Profanity tool? We can brute force to locate the private key with a much lower difficulty. We only need to specify the seed from 0 to 2^32-1 and repeat the same process until we locate the private key that can generate the same public key (and the Ethereum address). Since we only need at most 2^32 * loop_threashold calculation, this is doable in a couple of hours or days/weeks if we have a powerful GPU cluster.
However, this is still an optimized algorithm. You can refer to the article from Slowmist for more details.
About BlockSec
The BlockSec is dedicated to building blockchain security infrastructure. The team is founded by top-notch security researchers and experienced experts from both academia and industry. We have published multiple blockchain security papers in prestigious conferences, reported several zero-day attacks of DeFi applications, and successfully protected digital assets that are worth more than 5 million dollars by blocking multiple attacks.
- Twitter: [BlockSecTeam]
- Medium: https://blocksecteam.medium.com
- Website: https://www.blocksec.com
