Ethereum Proof-of-Work blockchain suffered from a second exploit

According to the cybersecurity firm BlockSec, the Ethereum Proof-of-Work (PoW) blockchain has suffered from a repeated exploit. As a result, the attacker received an additional 200 ETHW tokens after replaying a message from the proof-of-stake chain on ETHPoW. «The exploiter (0×82fae) first transmitted 200 WETH via the OmniBridge of the Gnosis chain and then replayed the same message on the PoW chain and received an additional 200 ETHW,» security company BlockSec reported on Twitter. According to the experts, the attack occurred because the bridge incorrectly checked the identifier of the inter-chain message.

1/ Alert | BlockSec detected that exploiters are replaying the message (calldata) of the PoS chain on @EthereumPow. The root cause of the exploitation is that the bridge does not correctly verify the actual chainid (which is maintained by itself) of the cross-chain message.

— BlockSec (@BlockSecTeam) September 18, 2022

The official Twitter account of ETH PoW recognized the attack. The ETHPoW blockchain development team reported that they had been trying to contact OmniBridge since Saturday to inform them of the risks. However, they did not respond immediately.

Had tried every way to contact Omni Bridge yesterday.

Bridges need to correctly verify the actual ChainID of the cross-chain messages.

Again, this is not a transaction replay at the chain level, it is a calldata replay due to the flaw of the specific contract. https://t.co/bHbYR4b2AW pic.twitter.com/NZDn61cslJ

— EthereumPoW (ETHW) Official #ETHW #ETHPoW (@EthereumPoW) September 18, 2022

The ETHPoW fork on the Ethereum blockchain went live this week after The Merge. According to TradingView, after the news of the exploit on Sunday morning, the ETHW token fell by more than 35%.