- A user lost $11 million in a phishing attack due to signing multiple fraudulent Permit signatures.
- Permit signatures, enabled through EIP-2612, allow off-chain transaction authorization, posing significant security risks.
- Security firms highlight the need for caution with Permit signatures and recommend using security extensions for protection.
In a recent incident, a user suffered a significant financial loss due to a phishing attack. The user lost $11 million worth of aEthMKR and Pendle USDe tokens after signing multiple Permit phishing signatures. This event shows the growing risks associated with digital asset security.The victim, who is a MakerDAO governance delegate, fell prey to the attack by unknowingly signing fraudulent Permit signatures.
Permit Signature Risks
The incident highlights the vulnerabilities associated with Permit signatures, a feature enabled through EIP-2612. This feature allows users to authorize transactions without prior on-chain approval, which can be exploited by malicious actors. The risk is heightened because the signature authorization happens off-chain, making it challenging to detect compromised signatures.
Analysis by Security Firms
Arkham Intelligence and blockchain security firm SlowMist have both analyzed the incident. According to SlowMist, Permit signatures pose significant risks as they can be easily exploited by bad actors. SlowMist noted that some wallets decode and display signature information to help users identify phishing attempts. However, there is often insufficient warning about the risks of Permit signature phishing.
Preventative Measures
Users are advised to exercise caution when interacting with smart contracts and signing off-chain signatures. Installing security extensions, such as those recommended by Scam Sniffer, can enhance protection against phishing attacks. Additionally, users should verify the legitimacy of websites and smart contracts before signing any Permit signatures.
This incident is a reminder of the importance of security in the digital asset space. As the use of smart contracts and digital tokens continues to grow, users must remain vigilant and take necessary precautions to protect their assets from phishing attacks and other forms of cyber threats.
Read also
disclaimer read moreCrypto News Land, also abbreviated as "CNL", is an independent media entity - we are not affiliated with any company in the blockchain and cryptocurrency industry. We aim to provide fresh and relevant content that will help build up the crypto space since we believe in its potential to impact the world for the better. All of our news sources are credible and accurate as we know it, although we do not make any warranty as to the validity of their statements as well as their motive behind it. While we make sure to double-check the veracity of information from our sources, we do not make any assurances as to the timeliness and completeness of any information in our website as provided by our sources. Moreover, we disclaim any information on our website as investment or financial advice. We encourage all visitors to do your own research and consult with an expert in the relevant subject before making any investment or trading decision.
