{"id":66271,"date":"2023-12-05T05:01:48","date_gmt":"2023-12-05T09:01:48","guid":{"rendered":"https:\/\/coinscreed.com\/staging\/?p=66271"},"modified":"2023-12-05T05:01:52","modified_gmt":"2023-12-05T09:01:52","slug":"thirdweb-discloses-common-security-flaw-in-smart-contracts","status":"publish","type":"post","link":"https:\/\/coinscreed.com\/staging\/thirdweb-discloses-common-security-flaw-in-smart-contracts\/","title":{"rendered":"Thirdweb Discloses Common Security Flaw in Smart Contracts"},"content":{"rendered":"\n

Thirdweb, a Web3 firm that develops smart contracts, has disclosed a security flaw that “may affect an assortment of smart contracts throughout the Web3 ecosystem<\/a>.”<\/p>\n\n\n\n

\"Thirdweb
Thirdweb Discloses Common Security Flaw in Smart Contracts<\/figcaption><\/figure>\n\n\n\n

Thirdweb disclosed a vulnerability in a widely utilized open-source library on December 4, which had the potential to affect particular pre-built smart contracts, including some that it had developed. <\/p>\n\n\n\n

Nonetheless, Thirdweb's investigations have determined that the smart contract vulnerability remains untouched, providing Web3 firms <\/a>with a limited time to avert a potential intrusion.<\/p>\n\n\n\n

Thirdweb stated, emphasizing the vulnerability's potential to cause catastrophic damage if not remedied immediately:<\/p>\n\n\n\n

\u201cThe impacted pre-built contracts include but are not limited to DropERC20, ERC721, ERC1155 (all versions), and AirdropERC20.\u201d<\/em><\/p>\n\n\n\n

The company proactively warned users who had deployed its contracts before November 22. These users were advised to “take mitigation steps” either independently or by utilizing a tool provided by the company.<\/p>\n\n\n\n

\n

IMPORTANT

On November 20th, 2023 6pm PST, we became aware of a security vulnerability in a commonly used open-source library in the web3 industry.

This impacts a variety of smart contracts across the web3 ecosystem, including some of thirdweb\u2019s pre-built smart contracts.\u2026<\/p>— thirdweb (@thirdweb) December 5, 2023\r\n \r\n \r\n \r\n <\/g>\r\n \r\n \r\n \r\n <\/clipPath>\r\n <\/defs><\/svg><\/span><\/a><\/blockquote>

Thirdweb also recommended that developers assist users in rescinding approvals on all impacted contracts through revoke.cash. “This will safeguard your users if you opt not to mitigate the contract,” DefiLlama developer “0xngmi” added in response to the request to revoke approvals.<\/p>\n\n\n\n

\n

btw this seems important, theyre asking to revoke all approvals to third web contracts (you might have interacted with them without knowing as theyre white-labelled, especially if you do stuff around nfts) https:\/\/t.co\/T1YU9xnIRb<\/use><\/svg><\/span><\/a><\/p>— 0xngmi is hiring (@0xngmi) December 5, 2023<\/use><\/svg><\/span><\/a><\/blockquote>

Thirdweb has initiated communication with the maintainers of the open-source library <\/use><\/svg><\/span><\/a>that contains the critical flaw and with other teams that may be affected by the situation.<\/p>\n\n\n\n

It also promised to implement a more stringent auditing procedure and increase funding for security measures and bug bounty payments by twofold, from $25,000 to $50,000. Additionally, the company provided a grant to address contract mitigations.<\/p>\n\n\n\n

\n

\u201cWe understand that this will cause disruption, and we are treating the mitigation of the issue with the utmost seriousness. We will be offering a retroactive gas grant to cover fees for contract mitigations.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n

For security purposes, complete information regarding the vulnerability was withheld. <\/p>\n\n\n\n

In August 2022, the company secured $24 million in Series A funding <\/a>from Haun Ventures, Coinbase, Shopify, and Polygon.<\/p>\n\n\n\n

Monthly usage of the Web3 company's multichain smart contract deployment tools for gaming, minting, marketplaces, and wallets is reportedly over 70,000 developers.<\/p>\n","protected":false},"excerpt":{"rendered":"

Thirdweb, a Web3 firm that develops smart contracts, has disclosed a security flaw that “may affect an assortment of smart contracts throughout the Web3 ecosystem.” Thirdweb disclosed a vulnerability in a widely utilized open-source library on December 4, which had the potential to affect particular pre-built smart contracts, including some that it had developed. Nonetheless, […]<\/p>\n","protected":false},"author":12,"featured_media":66276,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[21],"tags":[17468,1886,14826,6795],"class_list":["post-66271","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-security-flaw","tag-smart-contracts","tag-thirdweb","tag-web3-2"],"jetpack_featured_media_url":"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/12\/image-9.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/66271","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/comments?post=66271"}],"version-history":[{"count":0,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/66271\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media\/66276"}],"wp:attachment":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media?parent=66271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/categories?post=66271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/tags?post=66271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}