Uniswap / Uniswap/interface

URGENT: Phishing attack through "Send tab" auto suggest

Open
#7,654 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
5.5k
Forks
5.4k
PR merge metrics
No merged PRs in 30d

Description

My team got phished through the auto-suggest on the send tab interface. The attacker crafted an address that looks very similar to our destination address. The attacker then performed a zero-value transaction to emit a transfer event from my team's address to the crafted destination.

From Address: 0x7B8B698c2c62640a43DD187777DAf8C82F03a424
intended to address: 0xb8dcd6569453ede9a31f36a54e1534da79049ec0
attacker's to address: 0xB8D9B3186E9A4A8c104d9F7EE159B8d0C66b0Ec0

Note that the first five and last three characters are the same for the intended and the attacker's address (0xB8D....Ec0)

The transaction used by the attacker to make his account appear as a recently used address on uniswap:
https://polygonscan.com/tx/0x4ded02c9aefdce54e523748e74c2275a51aa16c968b44073d97481686ec15eab

In the above transaction, he sent 0 value from 0x7B8B698c2c62640a43DD187777DAf8C82F03a424 to his own crafted address 0xB8D9B3186E9A4A8c104d9F7EE159B8d0C66b0Ec0

Attack interface:
Screenshot 2024-02-20 at 09 19 49

Suggestion:

Remove auto-suggest on the sending interface or, at best, only suggest a previously used address entered manually on Uniswap.

PLEASE IMPLEMENT THIS FAST BEFORE MANY PEOPLE GET HURT!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The Send tab interface and its address auto-suggest are the entry points; begin by locating that flow and reviewing how suggestions are sourced. Done means removing the suggestions or limiting them to addresses previously entered manually on Uniswap, while preserving safe sending behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
blockchain, typescript
Domain
blockchain, frontend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
29/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.