In the rapidly evolving world of Web3, where digital assets are managed through blockchain technology, security is paramount. One significant risk that users face is the threat of malicious multisignature (multisig) attacks. In the latest SlowMist Security Team’s guide, originally published on SlowMist’s official channels, they delve into the intricacies of multisig mechanisms and offer insights on how to avoid falling victim to such risks.

Understanding Multisig Mechanisms

Multisig mechanisms are designed to enhance wallet security by allowing multiple users to manage and control a single digital asset wallet. This means that even if some managers lose or leak their private keys or mnemonic phrases, the assets in the wallet are not necessarily compromised. TRON, a popular blockchain platform, has a well-defined multisig permission system with three distinct levels of authority: Owner, Witness, and Active.

  • Owner Permission: This is the highest level of authority, allowing users to perform all contract operations and modify other permissions, including adding or removing signatories.
  • Witness Permission: Linked to Super Representatives, this permission enables participation in elections and voting related to Super Representatives.
  • Active Permission: Used for daily operations like transfers and smart contract calls, this permission can be set and modified by the Owner permission.

When a new account is created, it automatically has the Owner permission, which can be adjusted to授权 specific addresses with varying weights and thresholds. A threshold is the minimum weight required to execute a specific operation.

The Risks of Malicious Multisig

Despite the security benefits of multisig, it can be exploited by malicious actors who gain access to users’ private keys or mnemonic phrases. Here’s how:

Malicious Multisig Process

  1. Without Multisig: If a wallet is not set up with a multisig mechanism, a hacker can simply transfer the Owner or Active permissions to their own address, effectively taking control of the wallet.
  2. With Multisig: If a multisig mechanism is in place, a hacker might add their address as a signatory, requiring both the user and the hacker to sign off on transactions. This can leave users unable to transfer their assets without the hacker’s consent.
  3. Permission Transfer: In some cases, a hacker might directly transfer the Owner or Active permissions to their own address, removing the user’s control entirely.

Common Multisig Vulnerabilities

The SlowMist team has identified several common scenarios where users are at risk of malicious multisig:

  1. Downloading Fake Wallets: Users may inadvertently download malicious wallets from fake websites, leading to the exposure of private keys or mnemonic phrases.
  2. Phishing Websites: Entering private keys or mnemonic phrases on phishing websites that sell gift cards, VPN services, or other items can lead to loss of control over the wallet.
  3. OTC Transactions: During over-the-counter (OTC) transactions, private keys or mnemonic phrases may be compromised, leading to malicious multisig.
  4. Scam Offers: Scammers may offer private keys or mnemonic phrases, claiming they cannot access the assets and offering a reward for assistance. However, the multisig settings prevent the assets from being transferred.
  5. Phishing Links: Clicking on malicious links and signing malicious data can result in wallets being compromised.

Prevention and Best Practices

To mitigate these risks, the SlowMist team recommends the following:

  • Regularly check account permissions for any abnormalities.
  • Download wallets only from official sources.
  • Avoid clicking on不明 links and refrain from entering private keys or mnemonic phrases unless absolutely necessary.
  • Install antivirus software and anti-phishing plugins to enhance device security.

By following these guidelines, users can better protect their digital assets from malicious multisig attacks in the Web3 space. As the blockchain ecosystem continues to evolve, staying informed and vigilant is crucial to ensuring the safety of one’s assets.


read more

Views: 0

发表回复

您的邮箱地址不会被公开。 必填项已用 * 标注