153k Ether Stolen in Parity Multi-Sig Attack
I believe from looking at the fix [0] I was able to trace back the origin of the bug. This is my (unverified) theory. Can anybody familiar with serpent confirm?<p>There is a catch-all [1] function in the public API (why???) of the wallet contract which uses delegatecall to delegate to the library class.<p>"In a similar way, the function delegatecall can be used: the difference is that only the code of the given address is used, all other aspects (storage, balance, ...) are taken from the current contract." [2]  (again, WHY???)<p>So calling through this catch-all function the "internal" modifier on "initMultiowned" does apparently not prevent it from being called, since the delegation happens from a function inside Wallet.<p>So the "attack" is to just tell the wallet to reset its owners to myself. This would be so embarrassingly trivial, that it's more like picking the money up from the floor, than a "heist".<p>This wallet contract is insane and the programming language too. Why would a language for such a critical application have such super unsafe constructs? This can't be true. Please, serpent community, talk to your local PL people!<p>[0] <a href="https://github.com/paritytech/parity/pull/6103/files" rel="nofollow">https://github.com/paritytech/parity/pull/6103/files</a>
[1] <a href="https://github.com/paritytech/parity/blob/02d462e2636f1898df3e7556364260c594b112e6/js/src/contracts/snippets/enhanced-wallet.sol#L426" rel="nofollow">https://github.com/paritytech/parity/blob/02d462e2636f1898df...</a>
[2] <a href="https://solidity.readthedocs.io/en/develop/types.html#address" rel="nofollow">https://solidity.readthedocs.io/en/develop/types.html#addres...</a>
[3] <a href="https://github.com/paritytech/parity/blob/02d462e2636f1898df3e7556364260c594b112e6/js/src/contracts/snippets/enhanced-wallet.sol#L107" rel="nofollow">https://github.com/paritytech/parity/blob/02d462e2636f1898df...</a>