0

So, according to this article: https://blockgeeks.com/guides/underflow-attacks-smart-contracts/

"Imagine a situation where a token holder has only X tokens. Suppose he tries to spend X+1 tokens. If the program doesn’t even check for that, there is a chance that an attacker will end up with more tokens than what they actually have and get a maxed out balance.

Because of this condition, a hacker can actually own more funds than what they actually own and max out their balance. E.g. if the hacker owns 100 tokens and tries to own 101 tokens, they will end up with 100-101 tokens, which gives him 2^256-1 tokens as a result of underflow!"

Therefore, my question is this : is it true that a malicious hacker, by exploiting integer underflow in smart contracts, produce ridiculously large amounts (2^256-1) of tokens for himself? Wouldn't this be akin to creating money out of thin air?

EDIT: I found a similar case, in which someone exploited integer underflow/overflow to create unreasonably large amounts of BEC (BeautyChain) tokens for himself. This caused a lot of chaos back in 2018.

Improve this question
6
  • What's your question? – Ismael♦ Apr 30 '20 at 3:14
  • @Ismael My question is that: if the smart contract suffers from a underflow attack, does this mean that the attacker can create unreasonably large amounts of money for himself out of thin air? – Anonymous Apr 30 '20 at 3:22
  • It seems you already found examples where it happened. It might be that large amount of tokens were created, but usually those tokens value depreciate very quickly once the news is out. – Ismael♦ Apr 30 '20 at 3:48
  • @Ismael I see. But what if the coins used in the smart contract are Ether? Wouldn't creating near-unlimited amounts of Ether in a smart contract cause Ether's value to drop to zero? I'm thinking whether this would constitute as a potential attack/weakness against Ether...... – Anonymous Apr 30 '20 at 3:53
  • 1
    Please write an answer @Ismael so it can be upvoted – Lauri Peltonen Apr 30 '20 at 5:20
0

As your edit shows there are examples where contracts were exploited to mint a large amount of tokens. It might be that a large amount of tokens was created, but those tokens value will depreciate very quickly once the news is out.

The only way to create ether is mining blocks. A contract cannot create ether, it can only transfer existing amounts. The EVM primitive for ether transfers make validations before any transfer of ethers, so it is different from ERC20 where validations are done by smart contracts.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.