Blockchain Network is Secured! But not the apps and their Integrations

Sep 29, 2022 04:00 pm Cyber Security 161

During the security assessment for a blockchain-based web application, it was observed that some of the functions were vulnerable to unauthenticated ETH transfer from an admin wallet to the attacker’s wallet. The web application was a booking application where a user can book tickets and pay with a crypto token. Also, the application was integrated with Metamask framework to support web3 transactions over the blockchain.

User Initiates the ticket booking function. Let us say one ticket (T1) needs a payment of (0.1 ETH) to be transferred to the admin’s wallet.

The web application sends the request to transfer 0.1 ETH from the integrated Metamask wallet.

User signs the transaction from Metamask.

After a successful transaction of 0.1 ETH, the web application confirms the payment with a POST API call to
Support the originator by clicking the read the rest link below.