The Evolving Threat Landscape: Drainer-as-a-Service
One of the most pressing threats in current Web3 security is the proliferation of advanced “Wallet Drainers.” These are malicious toolkits, often sold as Drainer-as-a-Service (DaaS), designed to instantly empty a user’s wallet of all digital assets (tokens and NFTs) after the victim signs a seemingly innocuous transaction or signature request.
The Shift from Approvals to Malicious Signatures
While early scams primarily focused on tricking users into signing unlimited token approvals (e.g., approve(address(scammer), type(uint256).max)), the latest generation of drainers employs far more complex techniques. The focus has shifted toward exploiting standardized signature protocols, particularly EIP-712.
- EIP-712 Exploitation: When a structured signature request appears in the wallet interface, it often looks like a simple text message or a standardized data packet. Users frequently fail to recognize that signing this data grants the drainer the authority to execute malicious contracts, allowing them to sweep all balances.
- Bypassing Approval Checks: By leveraging signatures (like
permit) rather than direct approval calls, these attackers can often bypass typical on-chain security monitoring and make the theft process quicker and less visible to users who rely solely on approval revocation tools.
Common Attack Vectors
These sophisticated drainers are deployed predominantly via social engineering tactics:
- Fake Airdrops and Token Claims: Promising users rewards or free tokens, requiring a “claim signature” that is actually a drainer payload.
- Phony Governance Votes: Directing DAO members to compromised sites to participate in a “vote” that requires a malicious signature.
- NFT Mint Scams: Posing as limited-edition mints to induce users to approve or sign necessary transaction data.
Essential Security Recommendations
- Verify All Signature Requests: Scrutinize every request displayed by your wallet. If you do not fully understand the implications of words like “Permit,” “Sign Message,” or any structured data (EIP-712), do not sign.
- Utilize Hardware Wallets: Keep the majority of your valuable assets secured on a hardware wallet (e.g., Ledger, Trezor) where physical confirmation is required for every critical action.
- Regularly Revoke Permissions: Use tools like Revoke.cash regularly to review and remove unnecessary token approvals given to smart contracts.
コメント