Scan to download
BTC $67,788.99 -0.91%
ETH $2,044.22 -1.10%
BNB $632.89 +0.68%
XRP $1.42 -4.56%
SOL $81.67 -4.53%
TRX $0.2795 -0.47%
DOGE $0.0974 -3.83%
ADA $0.2735 -4.22%
BCH $486.53 -3.04%
LINK $8.64 -2.97%
HYPE $28.98 -1.81%
AAVE $122.61 -3.42%
SUI $0.9138 -6.63%
XLM $0.1605 -4.62%
ZEC $260.31 -8.86%
BTC $67,788.99 -0.91%
ETH $2,044.22 -1.10%
BNB $632.89 +0.68%
XRP $1.42 -4.56%
SOL $81.67 -4.53%
TRX $0.2795 -0.47%
DOGE $0.0974 -3.83%
ADA $0.2735 -4.22%
BCH $486.53 -3.04%
LINK $8.64 -2.97%
HYPE $28.98 -1.81%
AAVE $122.61 -3.42%
SUI $0.9138 -6.63%
XLM $0.1605 -4.62%
ZEC $260.31 -8.86%

transaction

Vitalik proposed to introduce a transaction simulation mechanism to enhance Ethereum's security and user experience

According to Cointelegraph, Ethereum co-founder Vitalik Buterin posted on the X platform on Sunday, suggesting improvements to the security and user experience of Ethereum wallets and smart contracts by introducing mechanisms such as "transaction simulation."Vitalik believes that security and user experience are not mutually exclusive areas; both revolve around user intent, with the core focus on ensuring that the operations executed by the protocol align with user expectations. His proposed "intent safety" solution includes: allowing users to view the simulated results of an operation before executing it on-chain, and then choosing to confirm or cancel; additionally, introducing spending limits and multi-signature approval mechanisms, allowing execution only when the user intent, expected results, and risk limits are all aligned, thereby lowering the threshold for low-risk operations while increasing the difficulty of executing risky operations.Vitalik also pointed out that defining user intent is inherently complex, which is the fundamental reason why there is no perfect security solution. It is not due to flaws in machines or designers, but rather that user intent itself is a complex object that users find difficult to grasp clearly. He stated that a common feature of excellent security solutions is that they allow users to express intent in multiple corroborative ways, with the system executing operations only when these expressions are consistent with each other.

GoPlus: Polymarket Hacked, Flaws in Off-Chain and On-Chain Transaction Result Synchronization Mechanism

According to disclosures from the GoPlus Chinese community, the prediction market platform Polymarket was hacked due to a design flaw in the synchronization mechanism between off-chain and on-chain trading results in its order system.The attacker manipulated the nonce, causing on-chain matched trades to be canceled or invalidated before execution, while off-chain records remained valid, leading to API false reports that affected trading behaviors of bots like Negrisk, resulting in user losses. The analysis of the attack process is as follows:The attacker submitted/matched large reverse trades with the market-making bot on the Polymarket off-chain orderbook.The attacker constructed transactions with forged/repeated nonces or utilized on-chain nonce competition, causing the on-chain transactions to inevitably revert.The Polymarket API returned "transaction successful" to the bot before on-chain confirmation, leading the bot to believe that the position had been hedged, while the actual on-chain state had not changed.The attacker then executed real on-chain trades to take advantage of the direction exposed by the bot, thus profiting "risk-free."Since the revert occurred at the chain level, Polymarket fees would not explode, making the attack cost controllable and executable continuously.GoPlus recommends that users pause automated trading tools, verify on-chain trading statuses, enhance wallet security, and closely monitor official announcements from Polymarket.
app_icon
ChainCatcher Building the Web3 world with innovations.