错误地验证签名 — AssociationNFT 案例

Code Auditing

April 21, 2022

Image: Raymond Clarke/Flickr

The Association NFT 是一个由 NBA 推出的 NFT。然而，我们发现其 NFT 销售合同存在严重漏洞，允许攻击者在不支付任何 Token 的情况下铸造大量 NFT。

该漏洞的根本原因是签名验证使用不当。基本上，该合同未能确保签名只能被用户（且仅被该用户）使用一次。在此情况下，攻击者可以重复使用一个特权用户的签名，并将 Token 铸造给自己。

我们可以看到，在 verify 函数中，签名中没有发送方的地址。此外，也没有机制包含一个 nonce 来确保签名只能使用一次。这些安全要求是在软件安全课程中的基础知识。

我们对如此流行的 NFT 项目中存在此类漏洞感到惊讶。整个社区需要更加关注合同的安全性。

关于 BlockSec

BlockSec 是一家开创性的区块链安全公司，由一群全球杰出的安全专家于 2021 年创立。公司致力于为新兴的 Web3 世界增强安全性和可用性，以促进其大规模采用。为此，BlockSec 提供智能合约和 EVM 链安全审计服务，Phalcon 平台用于安全开发和主动阻止威胁，MetaSleuth 平台用于资金追踪和调查，以及 MetaSuites 扩展，帮助 Web3 构建者在加密世界中高效冲浪。

迄今为止，公司已为 MetaMask、Uniswap Foundation、Compound、Forta 和 PancakeSwap 等 300 多家知名客户提供服务，并在两轮融资中从 Matrix Partners、Vitalbridge Capital 和 Fenbushi Capital 等知名投资者那里获得了数千万美元的投资。

官方网站：https://blocksec.com/

官方 Twitter 账号：https://twitter.com/BlockSecTeam

Tracing $1.6B in TRON USDT: Inside the VerilyHK Ponzi Infrastructure

Apr 8 2026Case Studies

Tracing $1.6B in TRON USDT: Inside the VerilyHK Ponzi Infrastructure

An on-chain investigation into VerilyHK, a fraudulent platform that moved $1.6B in TRON USDT through a multi-layered fund-routing infrastructure of rotating wallets, paired payout channels, and exchange exit funnels, with traced connections to the FinCEN-sanctioned Huione Group.

Weekly Web3 Security Incident Roundup | Mar 30 – Apr 5, 2026

Apr 8 2026Security Insights

Weekly Web3 Security Incident Roundup | Mar 30 – Apr 5, 2026

This BlockSec weekly security report covers nine DeFi attack incidents detected between March 30 and April 5, 2026, across Solana, BNB Chain, Arbitrum, and Polygon, with total estimated losses of approximately $287M. The week was dominated by the $285.3M Drift Protocol exploit on Solana, where attackers combined multisig signer social engineering with Solana's durable nonce mechanism to bypass a zero-timelock 2-of-5 Security Council, alongside notable incidents including a $950K flash loan TWAP manipulation against the LML staking protocol, a $359K Silo Finance vault inflation via an external `wstUSR` market donation exploiting a depegged-asset oracle and `totalAssets()` accounting flaw, and an EIP-7702 delegated-code access control failure. The report provides detailed vulnerability analysis and attack transaction breakdowns for each incident, covering flawed business logic, access control, price manipulation, phishing, and misconfiguration attack types.

Drift Protocol Incident: Multisig Governance Compromise via Durable Nonce Exploitation

Apr 3 2026Security Insights

Drift Protocol Incident: Multisig Governance Compromise via Durable Nonce Exploitation

On April 1, 2026 (UTC), Drift Protocol on Solana suffered a $285.3M loss after an attacker exploited Solana's durable nonce mechanism to delay the execution of phished multisig approvals, ultimately transferring administrative control of the protocol's 2-of-5 Squads governance with zero timelock. With full admin privileges, the attacker created a malicious collateral market (CVT), inflated its oracle price, relaxed withdrawal protections, and drained USDC, JLP, SOL, cbBTC, and other assets through 31 rapid withdrawals in approximately 12 minutes. This incident highlights how durable nonce-based delayed execution can decouple signer intent from on-chain execution, bypassing the temporal assumptions that multisig security implicitly relies on.

Best Security Auditor for Web3

Validate design, code, and business logic before launch. Aligned with the highest industry security standards.

BlockSec Audit