BlockThreat - Week 27, 2020

RavenCoin | Tendermint | Ledger | TrustWalletApp

Stand-alone blockchain vulnerabilities are rare but they still happen. Ravencoin was exploited with an inflation bug to mint 31M RVN while Tendermint patched up a DoS vulnerability. Another DeFi project was exploited to steal $900k. On the happier side of the week, our hero Harry hacked a phishing campaign C2 to save $5k worth of crypto for users who downloaded a fake wallet software.

Vulnerability

• Inflation bug was discovered and exploited in Ravencoin. $5.1M worth of RVN (31M coins or 1.5% of the total supply) were minted and already deposited to exchanges.

• A successfully exploited vulnerability in Vether resulted in $900k worth of VETH loss.

• Tendermint DoS vulnerability allowed block producers to include signatures for the wrong block resulting in a network halt on networks using the vulnerable version. The Cosmos network was using an unaffected version of Tendermint.

• A potential social engineering attack vector in Ledger Live wallet when dealing with Bitcoin’s Replace by Fee (RBF) tran…