Parity Hack: How It Happened, And Its Aftermath

On November 6th, 2017, Github user devops199 posted the following statement under the Github issues section of the Parity Multi-Sig Library: “I accidentally killed it”. Just moments earlier, devops199 exploited a vulnerability within the smart-contract library code, blocking funds in 587 wallets holding a total of 513,774.16 Ether as well as various other tokens. So what exactly happened and, more importantly, what as the aftermath?

First, let’s see how it all started. Following the aftermath of the first Parity hack, the WalletLibrary contract was deployed on July 20th. The lines one should take most notice of are lines 215 (only_uninitialized) and 225 (kill).

On November 6th, Transaction 0x05f71e1b was sent to WalletLibrary, which called the initWallet method. This transaction ended up making the 0xae7168deb525862f4fee37d987a971b385b96952 the sole owner. Transaction 0x47f7cff7 called the kill method of WalletLibrary with 0xae7168deb525862f4fee37d987a971b385b96952 as the beneficiary address. Approximately 30 minutes later, Devops199 created Parity issue #6995 to document what had just occurred.

Devops199 posted a link to the issue in the Parity gitter channel, asking “Is this serious issue?”

He then followed up by asking “Will I get arrested for this?”. It seemed as though Devops199 failed to understand the consequences of what he had done, by stating “I’m eth newbie..just learning”

About three hours later, Parity released a warning on Twitter: “A user exploited an issue and thus removed the library code, as it seems unaware of the consequences. This froze funds in all Parity multi-sig wallets deployed after 20 July. We are analyzing the situation and release further details shortly.”

There are two possible approaches to actually recovering the funds:

1. Hardfork, in a similar fashion to the hardfork that occurred after the DAO. There’s the possibility that this could be done along with the planned Constantinople hardfork. However, there are various political, philosophical, and social ramifications of hardforking Ethereum to recover the lost funds and could lead to another “Ethereum Classic”. On Twitter, Vitalik Buterin gave a signal of impartiality by stating “I am deliberately refraining from comment on wallet issues, except to express strong support for those working hard on writing simpler, safer wallet contracts or auditing and formally verifying security of existing ones”
2. Implement EIP156, which provides a community-controlled way to recover funds during these types of events. Although this EIP doesn’t specifically solve the issue, this shows that there is some precedent for the community supporting this sort of method to avoid a hardfork.

It appears as though those funds will be locked, at least in the foreseeable future.

Let’s take a look at the aftermath of the hack — on November 15th, 2017 Parity posted a “Postmortem” detailing what exactly occurred, as well as the steps that the Parity team would commit to in the future. Parity stated that, as a result of the hack, “the entire ecosytem as a whole is in urgent need of procedures and tooling to prevent similar issues from happening again, in particular if and when the number and complexity of live contracts grows.”

Parity has decided to remove the ability to deploy multi-sig wallets until they’ve confirmed they have the proper security in place to ensure it doesn’t happen again. Secondly, they are going forward with another full-stack external security audit of all existing sensitive code (i.e. key generation, password management, signing etc.). Lastly, they will put more effort on finding external help and resources, including:

• Developing relationships with research teams focused on tooling, language testing, and research.
• Extending their bug bounty program.
• Supporting research and development of other smart contract languages and tooling.

Overall, these types of issues are caught better by doing a more comprehensive review with the community, as opposed to one-off audit firms. This vulnerability is a perfect example of why startups are choosing to use companies like Solidified in their audit process. With access to 150+ experts and a standardized review process that requires you to spell out your deployment practices, they stand a much better chance of finding these issues early, especially when millions of dollars are on the line.