NFT: A security flaw in Rarible allegedly allowed the theft of cryptocurrency wallets.

NFT: A security flaw in Rarible allegedly allowed the theft of cryptocurrency wallets.

Check Point Research (CPR) has discovered a security flaw in Rarible, the NFT marketplace with more than two million active users. If exploited, this vulnerability would have allowed a threat actor to steal users’ NFTs and cryptocurrency tokens in a single transaction. CPR immediately disclosed its findings to Rarible, who acknowledged the error. This is the second time CPR researchers have discovered security vulnerabilities in an NFT marketplace. In October 2021, CPR discovered vulnerabilities in OpenSea, the world’s largest NFT marketplace. When he witnessed a similar attack on Jay Chou, a famous Taiwanese singer, whose NFT was stolen and sold for $500,000, CPR prompted an investigation into Rarible.

In 2021, Rarible reported a trading volume of over $273 million, making it one of the largest NFT marketplaces in the world.

CPR described the attack method as follows:

1. The victim receives a link to the malicious NFT or browses the marketplace and clicks on it.

2. The malicious NFT executes JavaScript code and tries to send a setApprovalForAll request to the victim.

3. The victim submits the request and gives the attacker full access to this NFT/crypto token.

On April 1, CPR witnessed a similar attack on Jay Chou, a famous Taiwanese singer. He was tricked into making a transaction in which his BoardAppe NFT 3738 was stolen, which was then sold in the market for $500,000. This surprised CPR, as the victim of this method could be any crypto/NFT holder. CPR quickly launched a thorough investigation of Rarible. The purpose of this latest research is to prevent the risks of account recovery and theft of cryptocurrencies.

CPR’s current findings build on previous research conducted in October 2021 that discovered critical security vulnerabilities in OpenSea, the world’s largest NFT marketplace. If left unpatched, vulnerabilities discovered on OpenSea’s platform could allow hackers to hijack user accounts and steal entire cryptocurrency wallets by creating malicious NFTs.

CPR reported its findings to Rarible on Tuesday, April 5, 2022. Rarible acknowledged the security breach. CPR believes that Rarible will have implemented a patch by the time of this release.

Oded Vanunu, Head of Product Vulnerability Research at Check Point Software explains, “CPR has committed significant resources to exploring the nexus between crypto and security. We are still seeing significant efforts from cybercriminals looking to steal large amounts of cryptocurrency, especially from NFT marketplaces. Last October, CPR discovered security vulnerabilities in OpenSea, the world’s largest NFT marketplace. However, we have identified similar vulnerabilities in Rarible. In terms of security, there is still a huge gap between Web2 and Web3 infrastructure. Any vulnerability, no matter how small, opens a back door that allows cybercriminals to stealthily hijack cryptocurrency wallets. We are still at the stage where marketplaces that combine Web3 protocols do not have a strong security practice. The consequences after a cryptocurrency hack can be extremely serious. We have seen millions of dollars diverted from users of marketplaces that combine blockchain technologies. I expect a continued increase in cryptocurrency theft. Users should be careful. They are currently required to manage two types of wallets: one for most of their cryptocurrencies and another just for transactions. If the trading book is ever compromised, they don’t risk losing everything. CPR will continue to study the security implications of this new frontier of blockchain technology.”

CPR advises to be careful and vigilant when receiving signature requests, even on the marketplace itself.

Before approving a request, users should carefully consider what is being requested and determine if the request seems abnormal or suspicious to them.

When in doubt, users are advised to decline the request and consider further before granting any kind of consent

Leave a Comment