Ethereum Layer 2 Platform Platfor

The ETHEREUM LAYER 2, ABSTRACT, has released the post -death in a security incident that led to a 400,000 -dollar compromise of ETH across 9000 wallets interacting with Cardex, a Blockchain game on its network.

The report clarified that the violation stems from the weaknesses of the Cordx front -facing symbol instead of a problem with the basic key verification contracts in the summary.

Cardex wallet leveling

The accident revolves around the misuse of the session’s keys, which is a mechanism in the abstract global wallet (AGW) that allows temporary and brief permissions to improve the user experience.

Although the session key keys is a well -backed safety feature, Cardex has made a decisive mistake using the common Signer Signer wallet for all users, an irreplaceable practice. This defect was more amplified by exposing the special key to the card to the front end of the front, which ultimately led to exploitation.

According to the radical cause of the summary analysisThe attackers identified an open session of a victim, and they began to treat Buyshaares on their behalf, then used the key to the risk to transfer the stocks to themselves before selling them on the Cardex Card to extract ETH.

More importantly, only ETH used inside Cardex was affected. Meanwhile, symbols and NFTS for users have remained safe due to the restrictions of the session’s key permissions.

The events of the events indicate that the first signs of suspicious activity were marked at 6:07 am US EST on February 18 when a developer published a transaction link showing the drain boxes. In less than 30 minutes, Cardex was suspected as a source of exploitation, and security teams soon mobilized for investigation.

Within hours, mitigation steps were taken. This included preventing access to Cardex, and publishing the cancellation site, as well as upgrading the affected contract to prevent more transactions.

The summary summarizes many measures to prevent future accidents of this type. To go ahead, all applications listed in their gate must undergo a tougher security review, including front software audits to prevent sensitive switches. In addition, the use of the session key will be re -evaluated through the applications listed to ensure the appropriate domain practices and storage. The documents will be updated on the implementation of the session key to enhance best practices.

What awaits us

In response to this violation, the summary also integrates the Blockaid transactions simulator in AGW, which will help users to know the permissions they give when creating the session keys. More collaboration with ownership and luxury to improve the main safety of the session.

The keyboard of the session key will also be presented in the portal, which users are expected to give a central interface to review and cancel their open sessions.