Dwallet Labs Says It Uncovered Infstones Validator Vulnerabilities Which Left $1 Billion in Staked Assets ‘Compromised’

Cyber security firm Dwallet Labs said on Nov. 21 that vulnerabilities it found on several Infstones (a validator company) validators a few months ago “meant over $1B of staked assets were compromised.” Infstones has acknowledged the existence of the vulnerabilities but says it “disagrees with the severity of the potential impact.”

Traditional Web2 Threats

According to the cyber security firm Dwallet Labs, a security research study initially showed that one validator belonging to Infstones had “a potential vulnerable entry point.” The security firm argued that the vulnerability, which was uncovered more than four months ago, highlights the still significant risks posed to validators by traditional Web2 threats.

1/ Web3 security usually focuses on native Web3 primitives like smart contract. However Web3 runs on servers, and those are susceptible to traditional Web2 threats. This vulnerability highlights that traditional attack vectors are at least as important, if not more so.

— Omer Sadika (@omersadika) November 21, 2023

To prove such a vulnerability could be used to launch a devastating attack, Dwallet Labs said it created its own node on Infstones “to run our own nodes and attack them.” This step enabled the security firm to gain “full control and extract keys.” By repeating this type of attack, Dwallet Labs uncovered more vulnerabilities. The security firm was subsequently able to affect over 1,000 Infstones servers and “to get full control, including extracting validator keys that are stored locally on the server.”

Vulnerabilities a Threat to Staked Assets

In a Medium post which details the findings of the security research, Elad Enerst, a security researcher at Dwallet Labs, explained that the research had “focused on attacking blockchain networks from a more traditional angle.” The plan, he said, was to treat validators as normal cloud servers and to attack them using what he described as classic techniques.

4/7 However, InfStones disagrees with the severity of the potential impact. They responded saying that the vulnerability could only affect a small fraction of the live nodes it has launched.

— CRYPTOTAG (@CRYPTO_TAG) November 21, 2023

Meanwhile, in a social media post discussing the potential consequences if a bad actor were able to gain such control, Omer Sadika, the CEO at Dwallet Labs, said:

“The impact of the affected servers meant over $1B of staked assets were compromised, with validator keys that could be stolen for over 1.2% of the stake of Ethereum and 3.9% of Lido. Attackers could exploit vulnerabilities like these in many validator providers to extract keys until they get enough power to take over and/or censor networks.”

For Sadika and his team, uncovering the vulnerability demonstrates that despite having an air-tight smart contract, the infrastructure used to run such a smart contract or code can potentially create an “attack vector that allows for completely taking over the network.”

Infstones Says Appropriate Steps Already Taken

While Infstones has acknowledged the existence of a vulnerability uncovered by Dwallet Labs, the former reportedly disputes the latter’s assessment of “the severity of the potential impact.” According to a post shared by Cryptotag on X (formerly Twitter), Infstones believes the vulnerability found in 237 instances accounts for less than 0.1% of the live nodes it has launched to date.

Still, the social media post said Infstones has already resolved some of the issues raised by Dwallet Labs in its lengthy report.

However, in a later post following reports that Infstones had taken appropriate steps to resolve the issues highlighted by his firm, Sadika seemingly bemoaned Infstones’ attempt to downplay the problem.

“The worst way to handle a cybersecurity vulnerability is not taking responsibility and lying. We were super open and transparent with the goal of eliminating the risk to Web3. My take: it’s not about whether you are fully secure or not, because no one is, it’s about how you handle it and maintain the trust with your partners and customers,” Sadika stated.

What are your thoughts on this story? Let us know what you think in the comments section below.