EOS Core Arbitration Forum


Case number: #ECAF00000441

Status: Open

Complaint: Exploitation of vulnerability in Claimant’s smart contract to move funds without authorisation

The Parties

Claimant: Smart contract developer

Respondent: As yet unidentified person(s)

Procedural History

  • 14 Sep 2018, 0303 UTC: 1st of allegedly fraudulent transfers from Claimant’s EOS account to Respondent’s EOS account
  • 14 Sep 2018, 0424 UTC: Case filed with ECAF
  • 14 Sep 2018, 1323 UTC: Case assigned to Emergency Arbitrator (EA)
  • 14 Sep 2018, 1342 UTC: EA requests Claimant to:
    • prove control of the EOS account by sending a transaction with a given memo
    • sign waiver and request for emergency freeze
  • 14 Sep 2018: EA conducts further dilligence into claimed exploit:
    • Reviewed Claimant’s and Respondent’s EOS accounts transaction history and code
    • Reviewed public information sources to verify that Claimant had indeed had a vulnerability as claimed
    • Contacted an external expert to review and explain the source of the vulnerability
  • 15 Sep 2018, 0140 UTC: Claimant replies confirming they will send proof of control by submitting ECAF fees with Case # as memo. Indicates that team were travelling and so could not reply to the EA earlier. Also submits signed waiver.
  • 15 Sep 2018, 0907 UTC: EA requests additional evidence
  • 15 Sep 2018, 0938 UTC: First of 5000 EOS transfer by Respondent of funds out to OTCBTC Exchange
  • 15 Sep 2018, 1020 UTC: Claimant submits proof of control by on-chain transaction with correct memo
  • 15 Sep 2018, 1104 UTC: EA, based on the merits of the case, affirms that there is a basis for an Emergency freeze. Requests claimant to submit bond corresponding to 20% of the claimed damages
  • 15 Sep 2018, 1112 UTC: Claimant requests clarification of the intent/purpose of the bond. Further emails with the EA to clarify ensue over the course of a day
  • 15 Sep 2018, 1132 UTC: Respondent commences transfers of remaining funds to 2nd EOS account and from there to Binance exchange
  • Case is on-going.