Root + Impact

Description

The current statistics on protocol funds lost confirm that, even with multisig, such attacks succeed. Functionality for emergency blocking or cancellation of a transaction is required.

Risk

Likelihood:

• Even though the likelihood is low by itself, human errors do happen.

• Not every signer might be suspicious of every transaction; transactions might be confirmed without a check.

• Also, an attack vector to trick a signer into transferring funds to a malicious address that resembles a previously verified one has become common and, in some cases, successful.

Impact:

• Loss of funds intended for internal protocol transfers might cause severe damage to the protocol, as such transfers are by nature less suspicious.

• Cannot recover from a compromised owner.

• Erroneous transactions cannot be cancelled.

• Must trust a single signer to never confirm malicious transactions.

• Pending malicious transactions remain a permanent threat.

Proof of Concept

1. One of the signers has been tricked into transferring funds to a malicious address that looks like the intended one.

2. It gets 2 confirmations before detection.

3. No way to cancel – must rely on the 3rd signer indefinitely.

4. Accidents or errors in transaction parameters cannot be fixed.

Recommended Mitigation

Allow any signer to cancel suspicious transactions before they are fully confirmed.