Cryptonews People In Crypto

ZenGo Warns of Dapp and Wallet Security Issue; Offers Solution

Dapp

DeFi Security Wallet

Journalist

Sead Fadilpašić

Journalist

Sead Fadilpašić

About Author

Sead specializes in writing factual and informative articles to help the public navigate the ever-changing world of crypto. He has extensive experience in the blockchain industry, where he has served...

Author Profile

Last updated:

June 26, 2023

Why Trust Cryptonews

Cryptonews has covered the cryptocurrency industry topics since 2017, aiming to provide informative insights to our readers. Our journalists and analysts have extensive experience in market analysis and blockchain technologies. We strive to maintain high editorial standards, focusing on factual accuracy and balanced reporting across all areas - from cryptocurrencies and blockchain projects to industry events, products, and technological developments. Our ongoing presence in the industry reflects our commitment to delivering relevant information in the evolving world of digital assets. Read more about Cryptonews

Keyless crypto wallet maker ZenGo has raised the crypto community to its feet, warning about a security issue that can suck all funds out of users’ accounts. The flaw has seemingly been well-known in the decentralized finance (DeFi) developer community, but it was not disclosed to users. ZenGo however, also offers a solution.

“Imagine going to your bank and sending someone USD 1,” but later “you discover that by doing so you have allowed this person to empty your account,” said ZenGo. Worse yet, your bank knew about this possibility but did nothing to prevent it from happening. Some of the most popular dapps (decentralized apps) and crypto wallets have this precise issue, which ZenGo named “baDAPProve.” But it was discussed only in the technical circles of Ethereum developers for years, while the users had no idea that it may happen or how it may affect them, they claim.

ZenGo describes baDAPProve as an exploit, whereby a smart contract can get unlimited access to the entirety of a user’s funds, while the user is none the wiser. Alex Manuskin, Blockchain Researcher at ZenGo, explains: DeFi companies build dapps implemented as blockchain smart contracts so that users can access DeFi services. To do so, users have to give permission for the dapp to interact with their wallet. This means that the dapp will ask the user for access to the tokens.

“The security issue is that while most users assume they approve access for a specific transaction of a specific amount, in most dapps users actually grant access to ALL of their holdings in that token. […] In almost every dapp, when the user connects to it, they unknowingly provide the smart contract associated with the dapp, full access to all of their funds, regardless of their actual usage.”

What does this mean for the user? If that dapp which was given permission to access tokens is vulnerable to a security issue or is malicious from the start, attackers can use the permission to take every single one of the approved token at any time, even when the dapp is no longer used – and it will not require any additional consent to do so. Users who decide to move out of DeFi due to recent price drops remain as vulnerable as they were before.

Furthermore, many wallets say nothing about it to their users, claims ZenGo, citing an unnamed wallet that says how communicating this to users in an understandable way would be difficult. Brave, Metamask, and Coinbase wallets display some warnings. Meanwhile, Opera, imToken, and Trust wallet give no warning whatsoever, ZenGo claims, and only Trust wallet is planning to upgrade their wallet as a result of their inquiry. We asked imToken and Opera for their comments as well.

“What is amazing in this is that many players we approached or even publications (won’t name) refused to consider it was a big deal,” tweeted Ouriel Ohayon, CEO of ZenGo, adding that any dapp is concerned here, not just DeFi. Manuskin writes that, though the problem has been known for years, “some security compromises that might have been acceptable in the era when users were scarce and highly technical are not acceptable when DeFi goes mainstream, acquiring many non-technical users, and handling crypto tokens in the Billions (USD).”

Therefore, the wallet maker built a publicly available, open-source testnet for all to experience baDAPProve risk-free. ZenGo also developed a security solution that they say solves most of the double confirmation issues, writing: “The approved sum is the same as the sum that the user intends to send, the user only approves once and both transactions are sent in parallel so the user does not need to wait any longer than usual.” The solution is meant for their Compound-based ZenGo Savings feature, but it’s not specific to automated lending platform Compound, meaning that other apps can use it too.

___

Learn more: Ethereum Locked in DeFi Rises, While Flash Loan Holes Are Being Plugged