In-Depth Analysis of  Flash USDC and  Stolen USDC   Attacks

Communication and Sharing

With the advancement of blockchain technology, digital asset trading has become an increasingly popular investment choice for many. However, along with this popularity, various phishing and theft attacks have emerged. Among them, "Flash and Steal" attacks and Unauthorized Transfer  attacks are two commonly encountered attack methods.

Definition and Principles of "Flash and Steal"Attacks

A "Flash and Steal"attack is a type of attack that exploits vulnerabilities in smart contract authorization to steal digital assets. Attackers somehow send users a phishing link or QR code, enticing them to authorize a certain amount of digital assets within a smart contract. They then proceed to conduct transactions or transfers using this authorization. By setting high transaction fees, attackers ensure the rapid transfer of authorized digital assets, resulting in the swift depletion of a user's digital assets.

The specific principles of a "Flash and Steal"  attack are as follows:

1. Attackers create a transaction page or QR code that closely resembles a legitimate digital asset transaction, luring users to click or scan.
2. Users input or scan information regarding digital assets and the transaction amount on the transaction page or QR code.
3. Attackers gain authorization from users through the smart contract's authorization feature, enabling them to perform transfers or transactions on the user's account.
4. Attackers typically set exceedingly high fees during the operation to ensure that the transaction is quickly included in the next blockchain block, expediting the transfer.
5. Once attackers successfully transfer a user's digital assets, they immediately move them to another address to avoid detection and tracking.

Definition and Principles of Unauthorized Transfer Attacks

An Unauthorized Transfer attack is a type of attack that exploits vulnerabilities in smart contract authorization to steal digital assets. Attackers acquire a user's private key or mnemonic phrase through various means and then use the authorization mechanism to manipulate the user's digital assets. Attackers can leverage the authorization mechanism of smart contracts to transfer the user's digital assets to another account, achieving their theft objectives.

The principles of an Unauthorized Transfer  attack are as follows:

1. Attackers obtain a user's private key or mnemonic phrase through various means.
2. Attackers use the user's private key or mnemonic phrase to access the user's digital asset wallet.
3. Attackers gain authorization from the user through the smart contract's authorization feature, allowing them to initiate transfers or transactions on the user's account.

Approve Contract Authorization Code

The "approve" contract is a critical smart contract in the Ethereum network used to implement authorization functionality, enabling a designated address to carry out transfers or operations on behalf of the authorizer. In the DeFi sector, the "approve" contract is widely used in token trading and liquidity mining scenarios, serving as a crucial component to ensure smooth transactions.

• authorizeUser: Allows the contract owner to add authorized users who can invoke restricted functions within the contract.
• revokeAuthorization: Permits the contract owner to revoke a user's authorization, preventing them from calling restricted functions.
• authorizedFunction: This is an example of a restricted function that can only be called by authorized users.

How to Guard Against "Flash and Steal" and Unauthorized Transfer Attacks

In Unauthorized Transfer attacks, attackers obtain a user's private key or mnemonic phrase through various means and then manipulate the user's digital assets using the authorization mechanism of smart contracts, transferring the assets to another account to achieve theft.

1. Raise awareness of security and exercise caution when encountering unfamiliar links and QR codes.
2. Avoid granting authorization for the use of digital assets without careful confirmation.
3. Use reliable wallets and trading platforms and verify their security settings and authentication mechanisms.
4. Regularly back up your private keys or mnemonic phrases and store them securely to prevent loss or leakage.
5. Consider implementing additional security verification mechanisms or multiple confirmations for large transfers or transactions.

Development Contacts