TL;DR#

On February 9, 2024, PlayDapp was exploited on the Ethereum Mainnet, which resulted in a loss of assets worth approximately $32.35 million.

Introduction to PlayDapp#

PlayDapp is a P2E game based on the Ethereum Mainnet.

Vulnerability Assessment#

The root cause of the exploit is reportedly due to the compromise of the private keys.

Steps#

Step 1:

We attempt to analyze one of the attack transactions executed by the exploiter.

Step 2:

As viewed from this transaction on February 9, 2024, at 01:39:23 PM UTC, roughly 6 minutes before the first exploit transactions, the address labeled `DozerDoll: Deployer` added a new minter on `PlayDapp: PLA Token`.

Step 3:

This address of the exploiter then deposited the newly minted 84.997 million PLA tokens to Polygon PoS Bridge in these first and second transactions, and then roughly 15 million PLA tokens were sent to yet another address.

Step 4:

This other address then further disbursed the minted PLA tokens to six different EOAs.

0xe84d086f2c402d297d05b1bccc06d0e0942ec03c: 500,000 PLA worth $80,887
0xe15f30be77c4074cb6c3c28e266fe426b70fffb8: 15,000,000 PLA worth $2,426,627
0x657a2834e1aa7dec89cd68c7d9dc7ac7299cc68e: 5,000,000 PLA worth $808,875
0xa1768359c71842c0891f67fc232ff744719a8518: 500,000 PLA worth $80,887
0x19daca4a10943b0f39ff880b74a47ec7ed17b949: 30,000,000 PLA worth $4,853,254
0xe80c3d6ef122f8aae6882fc448bd35bd0108034c: 49,000,000 PLA worth $7,926,982

Step 5:

These PLA tokens were further distributed to various EOAs to create mesh-like transaction hierarchies.

Aftermath#

The team acknowledged the occurrence of the incident and stated that they had directly notified all partner exchanges and were collaborating with them to suspend trading and address the unauthorized tokens.

A later tweet stated that as an immediate action to safeguard the PLA assets, the team is performing the mandatory transfer of all of the PlayDapp-held PLA tokens, including both locked and unlocked holdings, to a new, secure wallet.

Solution#

In addressing the vulnerability exposed by the recent PlayDapp exploit, it's crucial to emphasize the paramount importance of safeguarding private keys, which, when compromised, can lead to devastating consequences for DeFi protocols. A robust strategy for protecting these keys involves the utilization of secure storage solutions, such as hardware wallets for cold storage, which keep the majority of assets offline and thus less susceptible to online attacks. For operational liquidity, a minimal amount of assets can be stored in hot wallets, though with stringent security measures in place.

Implementing multi-signature wallets adds an additional layer of security, requiring multiple parties to authorize transactions, which significantly mitigates the risk of unauthorized access through compromised keys. Regular security audits and vulnerability assessments are essential to identify potential security loopholes and ensure that the protocols for managing and accessing private keys are updated and secure.

Continuous education and vigilance are necessary in light of the threat that phishing, social engineering, and malware like Trojan viruses pose. Regular security training for team members on the latest threats and secure communication practices can greatly reduce the risk of such attacks. Keeping software, including wallets and security tools, up-to-date is also critical for protecting against known vulnerabilities.

Users and investors are advised to perform due diligence before investing in blockchain projects, thoroughly researching and verifying the security measures in place for safeguarding assets and private keys. Awareness of recommended security practices and the correct types of wallets for storing tokens can further protect investors from potential threats.

Even with robust security protocols in place, the risk of vulnerabilities being exploited remains. In such cases, the role of Neptune Mutual becomes invaluable. By establishing a dedicated cover pool with Neptune Mutual, the negative impacts of incidents similar to the PlayDapp exploit can be greatly reduced. Specializing in providing coverage for losses stemming from smart contract vulnerabilities, Neptune Mutual employs parametric policies tailored to these unique risks. While losses due to private key compromises typically fall outside our coverage scope, exceptions may be considered under extraordinary circumstances.

Engaging with Neptune Mutual simplifies the recovery process for users by removing the need for extensive proof of loss documentation. Once an incident is confired and resolved through our detailed incident resolution framework, our priority shifts to promptly disbursing compensation and financial support to affected parties. This approach guarantees rapid assistance for users hit by such security lapses.

Our services extend across multiple leading blockchain platforms, such as Ethereum, Arbitrum, and the BNB chain, providing broad support for a wide range of DeFi participants. This widespread network allows us to offer protective measures against various vulnerabilities, enhancing safety for our diverse user base.

Reference Source PeckShield