Overview

The launch of “BRC-20” on the Bitcoin blockchain has generated significant excitement among users. BRC-20 is a concept similar to Ethereum’s ERC-20 token, enabling individuals to create their own tokens. This standard, introduced in March, utilizes the contentious Ordinals inscription technique developed in January. Previously limited to the Bitcoin token, the blockchain now hosts various coins such as $ORDI, $PEPE, and $MEME.

However, the introduction of these new tokens has not been entirely without issues. As developers raced to release wallets compatible with these tokens, UniSat wallet claimed to be the first to support them.Unfortunately, shortly after its launch, the developers discovered a vulnerability in the Chrome extension, rendering it inaccessible. They later disclosed that this vulnerability exposed the wallet to double-spend attacks.
The attack was noticed by the project team, who then reported the issue on Twitter.


UniSat Marketplace Hit by Double-Spend Attack

The recently launched UniSat Marketplace has fallen victim to a series of double-spend attacks. These attacks have exploited a vulnerability within the platform’s codebase, allowing malicious actors to spend the same cryptocurrency tokens multiple times. It is concerning that such attacks have occurred shortly after the marketplace’s introduction.

Despite efforts to anticipate and prevent double-spend attacks, the project team discovered certain vulnerabilities in the initial public version of the UniSat Marketplace. These vulnerabilities exposed the platform to exploitation, leading to the occurrence of these attacks.

Based on an initial analysis conducted by the extension’s team, approximately 70 out of the total 383 transactions were affected.


Double-Spend Attack

Double-spending refers to a type of manipulation in which the perpetrator spends the same cryptocurrency multiple times. It shares a historical connection with the Byzantine Generals’ Problem, which highlights the difficulty of achieving consensus without a central authority. The technological structure of Bitcoin effectively resolved this issue, and thus far, the Bitcoin network has never experienced a double-spend problem. Conversely, Ethereum has encountered this problem on multiple occasions due to its intricate operational system

What is the process through which double-spending occurs?

Double spending occurs when a person spends the same cryptocurrency on two separate occasions.

To understand how double spending happens, it’s important to consider the structure of blockchains, which consist of a series of transaction blocks. Each new block in the chain requires a hash, which is a crucial cryptographic function that includes details about public transaction data and the specific date the block was added.

Double spending can occur in a couple of ways.

  • Firstly, it can happen when services mistakenly consider a non-final block as a final one. This can lead to the duplication of payments for a transaction.

  • Secondly, inadequate transaction confirmation procedures by services can also contribute to double spending, as the payment for a transaction can be spent multiple times.

Flawed smart contract logic is another notable cause of double spending problems. If there is a lack of robust signature validation in place, users can potentially spend the same tokens twice, thereby exploiting the system.

Exploitation example:

Here’s a simplified example to illustrate a double-spend attack:

  • The attacker initiates a transaction to purchase a product or service on an online marketplace using a certain amount of cryptocurrency.

  • Simultaneously, the attacker creates another transaction using the same funds to send them to another wallet address under their control.

  • The attacker tries to quickly broadcast both transactions to the network, hoping that at least one of them will be confirmed before the network recognizes the double spending.

If successful, the attacker will have effectively spent the same cryptocurrency twice, taking advantage of the time delay in transaction confirmation and exploiting any vulnerabilities in the system’s consensus mechanism.

The attack appears in various forms, including:

Finney Attack, how does it work?

Hal Finney devised a technique involving mining a block, including a transaction from wallet A to wallet B, and delaying its broadcast. In the meantime, the attacker pays a vendor and transfers funds to wallet C. If the vendor doesn’t receive an alert after waiting for some time, they assume the transaction is still in the mempool and complete the product transfer. Subsequently, the attacker broadcasts their block, causing the initial transaction to wallet A to supersede the recent transaction to wallet C. Consequently, the vendor never receives the payment, while the attacker successfully sends the funds to their alternate wallet.

Race Attack, how does it work?

ByteCoin, a prominent member of the Bitcoin network, introduced the concept known as the “race attack.” This attack occurs when two transactions compete to be included in a block. The transaction that successfully enters the block is considered valid, while the one that fails to do so is deemed unsuccessful.

Here’s how an attacker executes a race attack: Firstly, they send a certain amount of cryptocurrency to a victim without broadcasting the transaction. At the same time, the attacker initiates another transaction with the same cryptocurrency and broadcasts it to the network. The validators, responsible for approving transactions, prioritise adding the second transaction to the block since it’s the first one they encounter. Consequently, the victim’s transaction loses the race to be included in the block, resulting in the failure of the intended payment.

51% attack, what is it?

A 51% attack refers to a situation where a single entity gains control over a blockchain network by possessing a majority stake, enabling them to disrupt the network’s operations. This control grants them the ability to manipulate transactions in various ways, such as preventing them from being confirmed, altering the transaction history, and executing double-spend transactions.

Is it possible for double-spending issues to occur in real-world scenarios?

Double-spending issues can manifest in various real-life financial transactions, both in online and offline settings. However, the specific mechanisms through which they occur can differ based on the context. Here is an example illustrating a real-life scenario of double-spending:

During a video call, John informed either Alice or Bob that one of them would pay Jane $500 in cash. Jane approached Alice and requested the $500, which Alice provided, assuming it fulfilled their agreement. However, before Alice had a chance to inform Bob about her payment to Jane, Jane approached Bob and asked for $500 as well. Unaware of Jane’s prior transaction with Alice and not suspecting any deception, Bob gave her the $500.

In the given scenario, both Alice and Bob unintentionally paid Jane twice, constituting a form of double-spending within this specific context.

Ordinals Protocol and Records

Ordinals is a pioneering protocol that enables the creation of records within the underlying Bitcoin blockchain. These records are associated with specific satoshis and are added to the blockchain. Ordinals serve as digital artifacts capable of carrying diverse data formats, including text, JPEG images, PDFs, videos, and audio files.

In contrast, the BRC-20 standard utilizes records for deploying token contracts and facilitating their transfer. In the past, the Ordinals protocol encountered code errors that hindered the validation of 1200 records. The issue stemmed from a flaw in the protocol’s indexer function, which only considered records from the initial incoming transaction request prior to version 0.5.1 of the protocol.

UniSat Marketplace Reacts to the Vulnerability

In response to the vulnerability, the developers of UniSat Marketplace took swift action by promptly disabling the wallet and publicly acknowledging the issue via Twitter. They assured users that they were actively working on resolving the problem and emphasized their commitment to prioritizing the security of user funds.


Preventing from double-spending Attack :

Sound Consensus Mechanisms

In a blockchain system with a robust consensus mechanism, the occurrence of double-spending is effectively eliminated. Consensus mechanisms empower miners or validators to fulfill their responsibility of preserving the network’s integrity. The secure logic and design of these mechanisms inherently prevent any accidental or intentional double-spending problems from arising.

Inclusion of Nonce to Prevent Replay Attacks

Nonces are complex cryptographic values that undergo hashing to enable block mining. Each nonce value can only be utilized once, serving as a safeguard against replay attacks. By ensuring non-duplication, nonces play a vital role in upholding the integrity of the blockchain by preserving the uniqueness of each block.

Confirm if UXTO Has Been Spent

An Unspent Transaction Output (UTXO) is a data structure that contains information regarding the history and current state of a transaction. In the blockchain, every transaction has an output that can serve as the input for a subsequent transaction. However, an output only becomes a new UTXO once it has been spent by a user. To prevent double-spending, it is crucial to incorporate a system that verifies whether a UTXO has already been spent or not.

High Node Operation Cost

Executing a double-spending manipulation typically necessitates the attacker’s control over one or multiple nodes within the network. In the case of a 51% attack, the hacker must gain dominance over more than half of the nodes in operation.

To mitigate the risk of double-spending, blockchains often implement measures that raise the requirements for node operation. For example, Ethereum mandates staking 32 ETH (equivalent to $54,135) to become a node manager. This significant financial commitment acts as a deterrent, making it costly for potential double-spenders to carry out their malicious actions.

Blockchain Protocol and Smart Contract Audit

Double-spending attacks frequently arise as a result of vulnerabilities within the underlying blockchain protocol and smart contracts. To effectively identify and rectify these critical vulnerabilities, a comprehensive and professional audit is considered the optimal approach.

Conclusion:

The UniSat Marketplace experienced a vulnerability that was exploited by criminals, resulting in a double-spend attack. This incident emphasizes the significance of performing comprehensive code testing and audits before releasing it to the public. It is worth mentioning that our company, SCT ITALIA, specializes in conducting security audits for blockchain projects. We understand the importance of identifying and addressing vulnerabilities to prevent such attacks. The developers of UniSat Marketplace demonstrated commendable responsiveness by promptly addressing the issue and actively seeking a solution. However, it is advisable for users to exercise caution when utilizing the UniSat Marketplace wallet until the matter is fully resolved.