How does Chia deal with sleepminting? #9597
Unanswered
SlugFiller
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Sleepminting is an attack on Ethereum NFTs which uses the fact that ERCs only define a list of functions a contract must implement, and not their implementation.
The way it works is by implementing a contract that answers to ERC-721, mints the token to a victim's public address, then moves it to the attacker's address. From the perspective of the trade history, the token responds to ERC-721 and was created by the victim and then sent to the attacker, even though the victim never once signed any operation related to the token. In other words, this is a way to steal "trust" in the victim, or rather the victim's known public key.
Recommended ways to detect this is either to decompile the contract and check the code (difficult), or to use off-chain communication from the victim to verify whether or not they authorized the creation of the token. Neither option can be automated.
While Chia doesn't have art NFTs yet, this is an expected use-case, and more generally, the ability to trust a any piece of code or communication based on a known public key of a trusted authority is a fairly common requirement (Signed apps, GPG, and all of SSL are built on known public keys, after all).
So, what tools does Chia offer to verify a token/contract was actually signed off by a certain public key's owner, without having to reverse/decompile the puzzlehash?
Beta Was this translation helpful? Give feedback.
All reactions