URGENT: Phishing attack through "Send tab" auto suggest
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 5.5k
- Forks
- 5.4k
- PR merge metrics
- No merged PRs in 30d
Description
My team got phished through the auto-suggest on the send tab interface. The attacker crafted an address that looks very similar to our destination address. The attacker then performed a zero-value transaction to emit a transfer event from my team's address to the crafted destination.
From Address: 0x7B8B698c2c62640a43DD187777DAf8C82F03a424
intended to address: 0xb8dcd6569453ede9a31f36a54e1534da79049ec0
attacker's to address: 0xB8D9B3186E9A4A8c104d9F7EE159B8d0C66b0Ec0
Note that the first five and last three characters are the same for the intended and the attacker's address (0xB8D....Ec0)
The transaction used by the attacker to make his account appear as a recently used address on uniswap:
https://polygonscan.com/tx/0x4ded02c9aefdce54e523748e74c2275a51aa16c968b44073d97481686ec15eab
In the above transaction, he sent 0 value from 0x7B8B698c2c62640a43DD187777DAf8C82F03a424 to his own crafted address 0xB8D9B3186E9A4A8c104d9F7EE159B8d0C66b0Ec0
Attack interface:
Suggestion:
Remove auto-suggest on the sending interface or, at best, only suggest a previously used address entered manually on Uniswap.
PLEASE IMPLEMENT THIS FAST BEFORE MANY PEOPLE GET HURT!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The Send tab interface and its address auto-suggest are the entry points; begin by locating that flow and reviewing how suggestions are sourced. Done means removing the suggestions or limiting them to addresses previously entered manually on Uniswap, while preserving safe sending behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- blockchain, typescript
- Domain
- blockchain, frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 29/100