How can I redirect any value/tokens sent to an ERC20 wallet, to another wallet?
I heard of a new method of stealing currencies and would like to know how it works in practice. Basically, the bad guy spreads the privatekey everywhere on the web and funds the associated wallet with some tokens. Victims will then try to empty the wallet through the privatekey but the wallet has no GAS and any GAS sent to it is redirected to another wallet.
So all the thief has to do, is to spread the privatekey around and wait for victims to take the bait.
How would a contract like this look like?
-
Do you have links to source articles?– VictoryMay 7, 2018 at 23:58
Add a comment
|
4 Answers
This is how I picture it taking place, however, I've not read about this till now, so it's a shot in the dark.
Bad Guy: creates a smart contract which consists of following:
1) fallback function transfers any incoming ether/Gas to a proxy wallet.
2) contains a bait function draining the wallet for existing ERC20 funds.
3) does not verify code, and the average tech enthusiast won't be able to understand operational code so reverse engineer the source code will be too much time effort.
Bad Guy: Associates/deploys the contract from an empty wallet and starts social engineering the public to take his bait. Based on how thoughtful and convincing the bad guy's social engineering tactic is.
Innocent Guys: Rushes to empty the contract before someone else, creating an emotional rollercoaster and starts a domino effect between infected minds.
-
doesn't make sense. That kind of emotional rush is very unlikely to succed on a contract whose source code is not open– user38075May 10, 2018 at 11:49
-
You would be surprised by how many people in this space, actually don't bother looking into it. Phishing is an art, you'd be surprised how easy it is to trick the human hardware bug.– 6egicMay 10, 2018 at 11:59
According to this post, a smart contract does not have a private key.
I think this thief stuff is more working with a watcher on the address (who knows the private key) which trigger a transaction to another address everytime some ETH are incoming
-
Yes this the he case that i believe in.– user19060Jun 25, 2018 at 11:24
It is pretty easy to make a contract which will redirect funds to another address.
pragma solidity 0.4.23;
contract Steal
{
address thief = 0x42b12454ea6163ad77b6af71cd90fc60421fef5a;
function () payable
{
thief.send(msg.value);
}
}
But there is another problem here. You don't get a private key of a contract you create (at least I don't know how to get it ). When you create a contract the only thing you get is public key, not private key.
However you can publish private key you know and then try to convince people that they should transfer money to some other public key you provide ( public key of contract as above ).
It is rather social engineering hack then software hack as function to transfer funds to another contract/account is very simple.
-
what if the contract you just defined as 'steal' was owned by a wallet which private key was exposed? let's say the 'steal contract had a 'drain' function only callable by owner of contract. However, this function would not be callable if no gas, as you defined a payable which sends any msg.value received to an address– NowsyMeMay 9, 2018 at 1:01
My guess:
In order to send some GAS (ETH) to that account, the victim will have to send it using an address.
If the address is a contract, then the contract can easily redirect that GAS to another account automatically.
-
"then the contract can easily redirect that GAS to another account automatically." how would that look?– NowsyMeMay 8, 2018 at 10:31