A brief analysis of the 0 yuan purchase incident in Atomics Market

avatar
MetaTrust Labs
3 months ago
This article is approximately 699 words,and reading the entire article takes about 1 minutes
A 0-yuan purchase incident occurred on the much-watched Atomics Market trading platform, and a series of issues regarding the ARC-20 token triggered widespread discussions and questions.

Summary

2023-11-21 A 0-yuan purchase incident occurred on the much-watched Atomics Market trading platform, which has caused Atomics Protocol and its trading platform Atomics Market to fall into trouble recently. A series of questions about the ARC-20 token have sparked widespread discussion and questioning.

Atomicals Protocol & Atomicals Market

Atomics Market is an ARC-20 trading market that uses Atomics Protocol for ARC-20 transactions (Atomics Market and Atomics Protocls are not the same company)

Atomics Market issued a document on the 21st stating that it discovered a PBST flaw in its trading process based on the Atomicals Protocol, causing users to suffer losses when trading atom tokens.

A brief analysis of the 0 yuan purchase incident in Atomics Market

At the same time, Atomics Protocol issued an article on the 24th to counter Atomics Market’s remarks and pointed out that the cause of the problem was Atomics Market’s negligence in using SIGHASH_NONE to sign in transactions, putting its users at risk. Atomics Protocol stated and warned that Atomics Market should not use SIGHASH_NONE for signatures (it is worth noting that SatsX, which is also an Atomics trading platform, does not seem to have a similar situation)

A brief analysis of the 0 yuan purchase incident in Atomics Market

After analysis, it was found that the root cause of the 0 yuan purchase was that Atomics Market incorrectly used SIGHASH_NONE (TX:1623bf2997cde779dd9e0e2c54b5f7f196f36826dcb689e41acd7fff27ec5c93) in PSBT.

A brief analysis of the 0 yuan purchase incident in Atomics Market

Preliminary knowledge

Before we further analyze the reason, we need to understand some preliminary knowledge. This is because BTC does not use an account model like Ethereum.

UTXO

Bitcoin Unspent Transaction Outputs (UTXOs) represent a specific portion of Bitcoin ownership. Unlike traditional systems that utilize accounts and balances, Bitcoin operates through these individual Bitcoin segments. Each UTXO is defined by a specific value and represents a different portion of the Bitcoin transferred in the transaction.

A brief analysis of the 0 yuan purchase incident in Atomics Market

During the course of a transaction, UTXO is consumed and no longer exists. Therefore, this operation generates one or more new UTXOs. The collection of these UTXOs, called the UTXO set, is maintained and updated by all network nodes. This happens every time a new block handles transactions that generate and destroy UTXOs. The UTXO set plays a key role in enabling nodes to independently confirm the legitimacy of transactions and the Bitcoin they intend to spend.

PSBT

Partially Signed Bitcoin Transactions (PSBT) is a protocol in the Bitcoin ecosystem designed to increase the ease of transmitting unsigned transactions, enabling multiple participants to sign a single transaction simultaneously.

PSBT (Partially Signed Bitcoin Transaction) provides utility in a variety of scenarios. Consider creating a CoinJoin transaction involving three people. During this process, each of the three participants sends a message to the central coordinator. The message contains details of the UTXO (Unspent Transaction Output) they wish to include in the CoinJoin. Additionally, each participant specifies the address to which their share of Bitcoin should be returned after the CoinJoin transaction is completed.

A brief analysis of the 0 yuan purchase incident in Atomics Market

Whats the problem?

Atomics Protocol mentions that in a secure PBST exchange step, the seller signs a 2nd input containing ARC 20 Atomic and receives a 2nd output of the payment amount.

Once the seller needs to sign with SIGHASH_SINGLE - ANYONECANPAY, the buyer can add their input to receive funds and add the receiving address for their purchase of ARC 20 tokens.

A brief analysis of the 0 yuan purchase incident in Atomics Market

Then, Atomics Market does not use SIGHASH_SINGLE in swap, but SIGHASH_NONE.

We can look at the difference between NONE and SINGLE:

A brief analysis of the 0 yuan purchase incident in Atomics Market

Since Atomics Market uses NONE, only one input is signed, which means that only the number of tokens sold is verified. Failure to sign the output means that the received tokens are not verified. As a result, malicious users can buy the users tokens for 0 yuan without paying the tokens.

A brief analysis of the 0 yuan purchase incident in Atomics Market

asset loss

33, 000 $ATOM

Follow-up

Atomics Market promises to compensate users for their losses.

A brief analysis of the 0 yuan purchase incident in Atomics Market

Security advice

Project parties should conduct in-depth research on the protocols they rely on, products need to undergo sufficient testing and auditing, and pay attention to the protocols themselves and the recommendations of security agencies.

About MetaTrust Labs

MetaTrust Labs is a leading provider of Web3 artificial intelligence security tools and code audit services incubated by Nanyang Technological University in Singapore. We provide advanced AI solutions that empower developers and project stakeholders to secure Web3 applications and smart contracts. Our comprehensive services include AI security scanning, code auditing, smart contract monitoring and transaction monitoring. By integrating AI, we ensure a secure ecosystem and enhance trust between users and developers.

Website: https://metatrust.io/

Twitter: https://twitter.com/MetatrustLabs

Original article, author:MetaTrust Labs。Reprint/Content Collaboration/For Reporting, Please Contact report@odaily.email;Illegal reprinting must be punished by law.

ODAILY reminds readers to establish correct monetary and investment concepts, rationally view blockchain, and effectively improve risk awareness; We can actively report and report any illegal or criminal clues discovered to relevant departments.

Recommended Reading
Editor’s Picks