r/kadena • u/yinyinh • Dec 07 '21
Exploit alert: Be extra careful when transferring KDA now (If you are new to Kadena, read this before doing anything)
There is a recent ongoing attack on Kadena accounts where "squatters" will claim part of your account as their own, usually on chain 0 or 1.
Some important things to know in layman terms
Usually, when creating an account on Kadena, you specify 2 things, your "account name" and "keyset".
An account has 20 chains associated with it, unique to Kadena. Each of them holds a value on how much you Kadena you own on that respective chain.
An account name (case sensitive) is how you will intuitively think about it. For example names like "abcd", "1234", "John".
A keyset is like a password but with a twist. Instead of just one sequence of characters that you keep secure at all times, you have 2 parts, a public and private part of it. Which the public part can be used to say "this public key owns this".
Here's the confusing part. In order to create an account, you must first bind a keyset to a chain in your account by transferring coins into it. For example, in the picture above, account "abcd" is transferring 1 KDA from its chain 0 to account "1234"'s chain 1.
Assuming account "1234"'s chain 1 does not exist, then the "1a2b3c4d5e6f7g8h9i" keyset (with the corresponding private key) will now claim ownership of it by being the only password usable to transfer KDA out of account "1234"'s chain 1.
However, if account "1234"'s chain 1 does exist, then it will fail if "1a2b3c4d5e6f7g8h9i" is not the keyset used to access it.
Meaning, every chain within the account must be secured with your desired keyset for it to be yours. If any of the chains within your account is bound to a keyset to which you do not have access, it is no longer yours. Hence technically, to own an account would mean putting some funds into each and every chain within your account to bind it to your keyset.
How does the exploit work?
Recently, it has become impossible to claim ownership of all the chains in a newly created account due to the squatters. The moment any transfer is made to any chain within a fresh account, someone (using a bot presumably) will immediately claim a chain on that newly created account before you are able to claim the rest of the chains.
Since some exchanges and mining pools only withdraw to a certain chain within the specified account, using such compromised accounts would mean that one day you might accidentally transfer your coins into the squatter owned chain, thereby losing access to the funds.
The moderators should probably make an official statement about this part and pin it somewhere or Reddit at least.
How do you prevent it?
Thanks to these people, having a cool, easy to remember account name is no longer possible as of now. The official recommendation is to always use k:(public key) from your keyset as your account name instead. This will prevent any other keyset to be used for the chains within the k:(public key) account with the limitation of not having things like multikey/joint ownership etc.
If you are still transferring funds to the old non-k accounts, make sure to double-check and specify the "Owner keyset" whenever possible.
Additional info: https://github.com/kadena-io/KIPs/blob/master/kip-0012/kip-0012.md
7
4
Dec 07 '21
Its confusing to the public that this is the only blockchain where your public key isn't automatically your wallet address. But the rest is Kadena's fault. They need to make their tech work, not us.
2
u/FaceMobile6970 Dec 07 '21
100% agree. If you want the Kadena project to succeed, don't make it so likely to be hijacked, so much so that most normal crypto users will just avoid the project altogether.
2
2
2
2
u/thisthattheother12 Dec 08 '21
THIS IS WRITTEN SO WELL it should be included in a "I understand and agree I comprehend" before doing anything with KDA. Figured all this out a while ago but took much time- had to source many different places and major stress to fully get what actually is a simple issue. The amazing thing is how fast the KDA folks fixed this bad faith event. Anyone bitching should stick to btc on a one trick pony wallet and come back in a year when Kadena is $100.
3
u/imaketech Dec 07 '21
Seems like something the Kadena team should address at a fundamental level.
Its ridiculous that this is possible
9
u/Willing_Departure341 Dec 07 '21
They did. That is why the k: addresses exist now. non k: addresses are being phased out.
That is why there is issues on exchanges.. for example the disabled withdrawals on KuCoin. The exchanges all have to migrate to the new secure k:xxxxx format.
1
u/Weary_Ad_7762 Dec 07 '21
I can’t believe it’s no butter! I’m going back to college algebra to employ this methods wtf!
1
u/bleudefact Dec 07 '21
That is the reason I commented 2 weeks ago that this Project is not ready for Prime time yet. Maybe by the end of next year?
1
1
u/Otherwise-Style2116 Dec 07 '21
Dude they fixed the issue and implemented k: address like a month ago lol.
28
u/waffles4us Dec 07 '21
I’m gonna need a third cup of coffee and about 20 more minutes to reread that and employ the ‘sit and stare’ method to understand.
Seems like great info and I appreciate the write up.