UXLink Deploys New Ethereum Contract After Multisignature Wallet Exploit

On Wednesday, decentralized social platform UXLink revealed its plans to deploy a new Ethereum contract. This decision came after a multisignature wallet exploit enabled attackers to mint billions of unauthorized tokens, causing a dramatic decline in the value of its native asset.

Details of the Security Breach

According to UXLink, the newly developed smart contract has successfully passed a security audit and will soon be launched on the Ethereum mainnet. The project has opted to eliminate the mint-burn function in an effort to avert similar incidents in the future.

Confirming the breach on Tuesday, UXLink stated that a significant amount of cryptocurrency was moved to exchanges. The estimated losses from this hack are variable, with Cyvers Alerts reporting at least $11 million in stolen assets, while Hacken estimates the losses exceed $30 million.

This incident has exposed vulnerabilities within smart contract security that projects need to address. Marwan Hachem, co-founder and CEO of the Web3 security firm FearsOff, mentioned that the incident emphasized the dangers of proceeding without adequate security measures.

The attackers gained access to UXLink’s smart contract through a breach in the multisignature wallet, leading to the initial minting of 2 billion UXLINK tokens. As minting continued, the token’s price plummeted by 90%, falling from $0.33 to $0.033, with security firm Hacken estimating that nearly 10 trillion tokens were created.

Hachem explained that the UXLink breach stemmed from a delegate call vulnerability in their multisignature wallet. This flaw allowed the hacker to execute arbitrary code, seizing administrative control over the contract. This ultimately resulted in the unauthorized minting of tokens.

“This incident really highlights some design flaws in UXLink’s structure,” Hachem stated. “A multisignature wallet that wasn’t adequately protected against delegate call exploits, insufficient controls on who could mint, and a lack of built-in code to enforce the supply cap all contributed to the issue.”

He further elaborated that this situation illustrates the dangers of maintaining excessive centralized control in projects that portray themselves as decentralized.

From a technical perspective, Hachem asserted that the UXLink hack could have been averted with several standard safeguards.

• Implementing timelocks on sensitive actions, such as minting new tokens or altering contract ownership. “A delay of 24 to 48 hours allows the community to identify any unusual activities before they are executed,” Hachem noted.
• Renouncing minting privileges once the tokens are launched, preventing even insiders from creating additional tokens. Hachem emphasized that hard-coding supply caps directly into smart contracts would eliminate the risk of new tokens being minted.

On the operational front, Hachem underscored the necessity of independent reviews and continuous transparency.

“You can’t just audit the token contract. The multisig setup needs thorough examination as well,” he said, stressing the need for projects to publicize wallet addresses and require multiple signatures for every transaction.

The overarching lesson, according to Hachem, is that even widely utilized tools like multisig wallets should not be assumed to be infallible. He advocated for a push towards more decentralized governance and the inclusion of emergency stops for critical operations.

“UXLink’s incident underlines that rushing forward without maintaining solid and continuous security can erode community trust. It is far better to reinforce defenses from the outset,” Hachem remarked.