CRITICIAL SECURITY VULNERABILITY -- Hotfix

[owocki]

There is a critical security vulnerability in the production smart contract for YGE deployed at 0x8bcaadc84fd3bdea3cc5dd534cd85692a820a692

If you scroll through the smart contract, you can see that there is an attacker who keeps draining the funds of the smart contract every time there is new ETH in there.

this is a fix for what i think is the vulmerability, though i am not completely sure. i believe the attacker is creating new transfers where they claim an _amount that is higher than msg.value, thereby tricking the smart contract into thinking it received a trasnfer higher than it actually did, and then exploiting that in the receive flow by withdrawing more than they deposited

IMPORTANT - it is inadvisable to use YGE in any non-permissioned environment until a full security audit is performed on it.

[owocki]

24fa3d3 warns users not to use the system until we can do a security audit

[Dobrokhvalov]

Hi @owocki

I was able to reproduce the hack - https://etherscan.io/tx/0xf0712c5b5c675d39711d4c0bfc622f2060845310a6341159c4a968d68a94f7e1

The current deployed contract allows to withdraw it's ether to an ephemeral address -

youvegoteth.github.io/contracts/contracts/TransferIndex.sol

Line 114 in a3bcd87

_owner.transfer(_fee_amount);

As there were no checks for the fee amount, caller was able to withdraw any fee to any address calling newTransfer function.

I think you have fixed the vulnerability by adding fee amount check -

youvegoteth.github.io/contracts/contracts/TransferIndex.sol

Line 87 in a3bcd87

require(_fee_amount < msg.value);