Transaction Simulation Spoofing (TSP): The Next Wave of Wallet Drains

Transcript

some research in the previous month about transaction simulations spoofing. So we discovered that it is possible to build an app that has a simulation outcome really similar to what you want or you would expect to have. Therefore, there's no reason why not to trust, right? And then you would move forward. However, if you check the balance of the user, he got actually drained from all the wallet assets. So there are a few important things to know. This simulation was actually engineered to look safe.

It was appended with several calls that would perform that kind of math. The simulation was actually correct at the simulation time. Everything was fine. However, when the transaction is executed, there's a DAP uh the DAP is actually front running the user and upgrading the contract and changing the logic to be executed. And therefore we get to a level where the outcome is pretty different. So why does this attack exists and where does it come from? Basically in all blockchain system and this is for EVM and non EVM systems we have a different time between the moment that the transaction is checked in the wallet via simulation and when

the transaction is actually finalized on the blockchain. This gap leaves a time for the attacker to come in and uh change the outcome of the transaction. But this is not the only attack that leverage this kind of um feature from the blockchain. We also know ME uh fishing attacks uh front running sandwich attacks they all happen all these attacks happen because of the same gap that exists in the blockchain and they are very hard to discover because between a sandwich attack and a normal transaction or a market variation because the prices are always fluctuating. We don't know we cannot really tell with very high confidence what the reason was.

And if that wasn't bad enough, actually it gets worse because this was implemented in a malicious DAP. So you would say, "Oh, I may just pay attention to the DAP I interact with." However, this attack is very easy to u infect an npm package for instance that is used by several DAPs by wallets through a supply chain attack and therefore infect uh legally and projects uh main components. And so even for a safe transaction, it would be possible to add this attack and still drain. And for wallets and dabs, this would mean that their user base would actually be impacted.

So are we doomed? Is it the end? Should we quit? Uh the good news is uh we actually are trying to propose uh new standard that's actually focused on the fidelity of the transaction. Which means what basically what you see in the wallet simulation is what you're going to get otherwise the transaction is not included in the block. So how do we how do we do it? Uh we actually took this idea from the Treadfi where you sign contracts for any kind of service you get uh in Treadfi with your bank a loan uh currency exchange and we consider that uh what the user sees as their

intent. So this is what they were expecting to get and this is going to be used whenever the transaction is actually included in the block. We're going to verify that the outcome at the inclusion time matches the user intent with some slippage capability. If the intent matches the outcome, then it means that the user will be satisfied. The transactions will be included in the block. Otherwise, uh if the intent doesn't match the actual outcome, something went wrong and we it could be for many reasons. could be for the market evolution price changes. It could be uh because of an attack could be transaction simulations spoofing me. The good thing is that we just make sure

that whatever the user wants becomes our priority. And this is how we actually going to solve uh this problem. So the idea is really to solve blind signing by having simulations that are easy to understand in plain English mostly based on inflows and outflows and at the same time guarantee that whatever the user wants is actually what's going to happen at the end. So if you want to join the conversation feel free to to join us on telegram and uh to check it out our EIP as well. Thank you. Thank you so