The Ethereum blockchain has its own version of a creature operating under its waters in search of victims. Product Lead and Steward at Flashbots, the organization working to create a solution for the MEV issue, Robert Miller discovered what is potentially one of the biggest mysteries on this network.
Related Reading | Why Q1 2022 Will Be A Bullish Period For Bitcoin And Ethereum, Raoul Pal Says
Per a post on his blog, Miller described the process that allowed him to lure in the monster after receiving a tip on its existence. The creature in question is a bot that explores the Ethereum blockchain looking for transactions with a security vulnerability that has the potential to expose the user’s private keys.
The exploit comes from harvesting an “obscure mistake” in the process of creating a transaction on Ethereum, as Miller explained. This blockchain uses the Elliptic Curve Digital Signature Algorithm (ECDSA) to produce digital signatures and send transactions on the network.
The ECDSA is a key component on a blockchain that lets a user prove that he owns certain funds or assets. In that way, a digital signature produced with this algorithm proves that you own the private keys tied to the public keys used to send the assets and that the formers were used to sign a transaction. Miller said:
ECDSA works because of the fact that you can easily use a private key to generate a public key, but you can’t use a public key to derive a private key. You can, however, use a signature to back out a private key under some limited conditions.
In order to produce a signature, the ECDSA algorithm uses the private keys, the public keys, a random number (called nonce), and two fixed numbers. Thus, it generates a digital signature with two components which Miller referred to as r and s. This is how the Ethereum monster looks for victims.
The Bot Looking For Transaction Vulnerabilities On Ethereum
The bot looks for transactions that re-used the nonce for different transactions. In that way, the bad actor can take this data and used it to figure a user’s private key as the digital signature is the combination of two components calculated with a specific mathematical formula. Miller said:
If an attacker learns what nonce was used to generate a particular signature then they can recover the private key used to sign that message. (…) if a nonce is ever reused across two different signatures then the private key used to sign those signatures can be recovered.
Miller clarified that a regular user is unlikely to be affected by these security exploits as it requires technical knowledge and effort to modify a transaction for it to re-use a nonce. He took the private keys from an Ethereum wallet and created a “nonce-reuse-bait bot bait”.
His objective was to attract the monster looming on this blockchain. After he send transactions that meet the aforementioned requirements, Miller waited around a day to find that the ETH funds held on the bait wallet were gone. The monster attacked.
Miller discovered his attacker’s address with Etherscan and noticed that others fell prey to this bot, but not everyone had nonce vulnerabilities. This suggests that the bad actor employs several strategies to steal ETH funds from other users. He concluded:
There are also more complicated ways to exploit poor nonce generation. But still, this is speculation, and none of the tracks I investigated seemed to give any definitive answers. A creature of the dark forest may have revealed itself. But what it is or where it will strike next remains a mystery.
Related Reading | Ethereum 2021 Performance Gap Reaches 400% Compared To Bitcoin
As of press time, Ethereum (ETH) trades at $3,720 with a 2.54% profit in the 4-hour chart.
