khoji parkCrypto · London · 2017
One Deleted Code Library Froze Hundreds of Cryptocurrency Wallets
A single vulnerability in a shared contract library locked up hundreds of thousands of ether.
Read in slides1. Shared Library Architecture
The Parity MultiSig wallet was structured as a thin contract that delegated calls to a central library contract. This mechanism allowed multiple deployed wallets to reuse the same underlying code and reduce deployment costs. However, all functions within the library needed to be public so that thin contracts could invoke them. This openness included the initialization method used to set ownership states during construction.
Public visibility exposed the initialization method to outside calls.
2. The July Exploit
An attacker previously exploited the public initialization method by invoking it directly on target wallets. This action reset the wallet ownership to an address controlled by the attacker and siphoned the funds. To prevent similar incidents, developers added a modifier to ensure the initialization method could only run once during construction. This fix checked the target store to verify whether the contract had already been initialized.
Developers added a modifier to block repeated initializations.
3. A New Attack Vector
While the modifier successfully protected individual wallet contracts, the library contract itself remained uninitialized. The attacker targeted the shared library contract directly instead of attacking individual user wallets. Because the library had never been initialized, the ownership count was zero and the check passed. The attacker reset the owners of the library to an address of their choosing.
The attacker reset the ownership of the shared library.
4. State Vulnerability
Library contracts on the blockchain function as full-fledged contracts with their own data stores despite being used to deploy shared code. The shared library was not properly isolated from having its own state altered. This design flaw made the core library just as susceptible to manipulation as any standard contract. The attacker exploited this capability to take control of the library contract.
The shared library possessed an unprotected internal state.
5. Instant Freeze
Once the attacker gained control of the shared library, the next step was to kill the contract entirely. This action caused all the thin wallet contracts that relied on the library to point to an address with no code. The dependent wallets instantly lost their ability to execute transactions or transfer funds. Hundreds of multi-sig wallets holding massive amounts of cryptocurrency became completely frozen.
Killing the library contract instantly froze dependent wallets.
6. Massive Losses
The freeze trapped over 500,000 ether, valued at approximately $150 million USD at the time. This total included over 300,000 ether belonging directly to the Web3 Foundation team. The sudden inability to access funds impacted numerous projects and individual holders across the network. The incident highlighted the inherent dangers of allowing ether-receiving library contracts to be destroyed.
Hundreds of thousands of ether became permanently inaccessible.
7. Design Flaw Analysis
Technical analysis revealed that contracts designed as libraries should never have their internal state altered. Solidity later enforced this requirement by forbidding libraries from holding non-constant state fields. A verified implementation of the library pattern would have prevented mutable state fields from being targeted. Without standardized security patterns, minor coding oversights risked disastrous consequences.
The vulnerability exposed critical flaws in shared library design.
8. Remediation Efforts
The deleted library left affected wallets unable to execute the code they relied on. Their Ether had not simply been transferred to the person who deleted the library; access to it was frozen. Proposed recovery approaches did not immediately restore those balances. This was the November 2017 incident, distinct from the earlier Parity theft that July, even though the later library had been deployed after that earlier failure.
The balances were frozen rather than paid out to the caller.