The hard-forked Ethereum Proof-of-Work (PoW) blockchain was at the receiving end of a replay attack, according to BlockSec, a company that deals with blockchain infrastructure and security. BlockSec reported the issue on 18 September 2022 via Twitter.
A replay attack is a network exploit where hackers delay or fraudulently replay a transaction message on another chain to carry out the same transaction twice, or more. The contentious ETH PoW was always prone to such an attack post-Merge.
Currently, the Ethereum PoW token (ETHW) token is down by 96.53%, from its all-time high. This development, however, also has to do with crypto exchange Poloniex’s support for the rival Ethereum fork, EthereumFair, despite founder Justin Sun’s prior pro-PoW comments.
How was the attack initiated?
The hacker first sent 200 wrapped ETH on the PoS mainnet using the Gnosis chain’s Omni bridge. It was a standard bridge transfer. The same message (call data) was then replayed on the ETH PoW chain to get 200 ETHPoW (ETHW) tokens.
The attack could take place because the Omni bridge didn’t correctly verify the chain ID associated with the cross-chain message.
Team responds
The developer team said they have been trying to connect with Omni Bridge since 17 September to inform them about the associated risks.
In response, the developer team at ETHPoW also published a post on Medium arguing that the attack is an exploit of a bridge-specific smart contract vulnerability and not due to their blockchain per se. According to them, no chain-specific replay attack has been initiated to and from the ETH PoS chain as their security engineers had planned proactive and preventive measures beforehand.
The team’s core developers even explained that they implemented the EIP-155 to ensure protection against replay attacks.
