Another day, another white-hat takeover of an NFT project that isn’t writing their proxy contracts correctly.Here is the transaction: <a href="https://etherscan.io/tx/0xd9c6c47c20d86a0862d971652a2bc65f7fcb30139fe78ff59a8e3f1c0f634c6a">https://etherscan.io/tx/0xd9c6c47c20d86a0862d971652a2bc65f7fcb30139fe78ff59a8e3f1c0f634c6a</a>How it happened you may ask? Rather than explaining, Let’s recreate this hack for a deeper understanding of what exactly happened.Firstly, we need to fork the Ethereum Mainnet (since the contract is deployed on Ethereum) at block number 16546861, which was 1 block before the hack was performed.To make our live easier, just head out to BuildBear.io and create a private testnet forked from 16546861. Screenshot below:<figure class="image image_resized" style="width:679.997px;"><img src="https://miro.medium.com/v2/resize:fit:706/1*dG5mNeOYHziZd0rGBWB5qQ.png" alt="" loading="lazy"></figure>Click on ‘Add to MetaMask’<figure class="image image_resized" style="width:475.989px;"><img src="https://miro.medium.com/v2/resize:fit:480/1*yPfO08lpSJLDsKnBLbiM3A.png" alt="" loading="lazy"></figure>Visit the faucet, connect your wallet, enter the desired amount, and click on “Get BB Eth”.<blockquote>If you have noticed , we can also mint popular ERC20 Tokens. Isn’t this easy then using local Hardhat Network.</blockquote><figure class="image image_resized" style="width:679.997px;"><img src="https://miro.medium.com/v2/resize:fit:706/1*68gXqM_mJmQnvwiQOI2wYw.png" alt="" loading="lazy"></figure>Next, visit the BuildBear Explorer from teh home page and search for `0x583223027e4ae2b4466fcd51510992c6f64503de`<blockquote>Yes, every Testnet has its own Explorer</blockquote><figure class="image image_resized" style="width:679.997px;"><img src="https://miro.medium.com/v2/resize:fit:706/1*bzJ84tXteKKTrALQXLCDlQ.png" alt="" loading="lazy"></figure>In the contracts section, we will move to the ‘Write Contract’ section and click on ‘Connect to Web3’ to connect the explorer to our wallet. Make sure that you are on the custom Testnet.<figure class="image image_resized" style="width:679.997px;"><img src="https://miro.medium.com/v2/resize:fit:706/1*8E2T3DiXQ1kxAoFxsQr_Ow.png" alt="" loading="lazy"></figure><h1 style="margin-left:0px;">The HACK</h1>Call the ‘Initialize’ function and enter your wallet address.<figure class="image image_resized" style="width:679.997px;"><img src="https://miro.medium.com/v2/resize:fit:706/1*qKFNd0XZ7YM6OyPI16BCng.png" alt="" loading="lazy"></figure>Finally, click on ‘Write’ and sign the transaction on our wallet.<blockquote>We did it, now you are the owner of this contract and have the ability to call any owner-only functions on the implementation contract.Isn’t this easy.</blockquote><figure class="image image_resized" style="width:679.997px;"><img src="https://miro.medium.com/v2/resize:fit:706/1*ENTzWUdAygYGJ3U1GSG6uA.png" alt="" loading="lazy"></figure><blockquote>Since we are NOW the owners, let’s airdrop some Nfts to ourselves.</blockquote><figure class="image image_resized" style="width:375px;"><img src="https://miro.medium.com/v2/resize:fit:378/1*w9IHG2WjYDWcgrmwYRN79Q.png" alt="" loading="lazy"></figure><figure class="image image_resized" style="width:679.997px;"><img src="https://miro.medium.com/v2/resize:fit:690/1*qlxuj8hxVForMnYsoT7m4g.png" alt="" loading="lazy"></figure>We have successfully recreated the hack and got ourselves some NFTs🎉🎉<h2 style="margin-left:0px;">Let me also show how you can prevent this hack</h2>It’s simple, there’s something called `_disableInitializers` that you should add to your implementation’s constructor. More info here <a href="https://t.co/YavxlGlP2W">https://t.co/YavxlGlP2W</a>Here is more information about proxy smart contractsPoxy contracts are used in the context of upgradeable smart contracts. Upgradeable smart contracts are composed of 3 contracts:<ul><li>Proxy contract. The smart contract that the user interacts with. It will keep data/state which means data is stored in the context of this proxy contract account. This is an <a href="https://eips.ethereum.org/EIPS/eip-1967">EIP1967 standard</a> proxy contract.</li><li>Implementation contract. The smart contract provides functionality and logic. Please note that the data is also defined in this contract. This is the smart contract you are building.</li><li>ProxyAdmin contract. The contract links Proxy and Implementation.</li></ul>ProxyAmdin explained in <a href="https://docs.openzeppelin.com/upgrades-plugins/1.x/faq#what-is-a-proxy-admin">OpenZeppelin docs</a>:<blockquote>What is a proxy admin?ProxyAdmin is a contract that acts as the owner of all your proxies. Only one per network gets deployed. When you start your project, the ProxyAdmin is owned by the deployer address, but you can transfer ownership of it by calling transferOwnership.</blockquote>If you transfer ProxyAmin ownership to a multi-sig account, the authority to upgrade the Proxy contract (link proxy to new implementation) is transferred to it.If you want to know how to modify a contract to be upgradeable, you can refer to the OpenZeppelin docs: <a href="https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable">link</a>.<blockquote>This is for education purposes only.</blockquote>About BuildBear:BuildBear is a platform for testing dApps at scale, for teams. It provides users with their own private Testnet to test their smart contracts and dApps, which can be forked from any EVM chain. It also provides a Faucet, Explorer, and RPC for testing purposes.BuildBear aims to be building an ecosystem of tools for testing dApps at scale for the teams.If you appreciate what we are doing, please follow us on <a href="https://twitter.com/_BuildBear">Twitter</a>, and L<a href="https://www.linkedin.com/company/build-bear/">inkedIn</a> and <a href="https://t.me/+6mjOnBFUR9xjN2U1">Join the Telegram</a> group if you haven’t done yet.And please give us a clap 👏 if you like our work.Authors: <a href="https://twitter.com/chandan1_">Chandan</a>

Recreating Kubz NFT Hack and understanding what went wrong

Let’s get started then, Shall we?

Let’s get started then, Shall we?

Test DApps at Scale.