GuShiio.com Dilation Effect analysis pointed out that compared with previous similar incidents, in the Bybit incident, only one signer was needed to complete the attack because the attacker used a social worker skill. Analyzing the transactions on the chain, we can see that the attacker executes the transfer function of a malicious contract through delegatecall. The transfer code uses the SSTORE instruction to modify the value of slot0, thereby changing the implementation address of the Bybit cold wallet multi-signed contract to the attacker address. Only need to deal with the person/equipment who initiated the multi-signature transaction, and when several reviewers later see the transfer, they will greatly lower their vigilance. Because normal people see a transfer and think it is a transfer, but who knows it is actually a contract change?
read the original
