关于USDT 虚假转账安全⻛险分析的看法

0x01: 前言: 这两天出差 回来看到这个文章

原文链接

「慢雾区」公众号发布

0x02: 简单介绍

如果⼀笔 USDT 的交易合法的，要⾄少满⾜以下 2 个条件：

• 1.要通过⽐特币的交易来构造，要符合⽐特币的余额验证（BTC）及交易规则验证

• 2.要通过 USDT ⾃⼰的余额（USDT）验证

被 USDT 冻结的地址发起的交易也会被标记为⽆效交易。
https://omniexplorer.info/address/3MbYQMMmSkC3AgWkj9FMo5LsPTW1zBTwXL

推测的可能攻击过程如下:

• 1.向交易所钱包构造并发起⽆效（虚假）转账交易；

• 2.由于逻辑判断缺陷交易所将⽆效交易⼊账并计⼊到⽤户在交易所的资⾦账户；

• 3.⽤户发起提币；

• 4.交易所处理⽤户提币将币打到⽤户⾃⼰钱包地址；

• 5.⽤户⾃⼰充币环节 USDT 没有任何损失，提币环节交易所把⾃⼰真实的 USDT 币打给⽤户，造成交易所损失。

个人看法

从这个攻击行为来看 的确是个风险 但是影响不大 ，每个地方都会存在过失，就像说登陆的时候可以任意用户登陆一样，不需要正确的账号密码 em 好像是这样。不过也是值得关注的 毕竟bug无处不在.

https://github.com/OmniLayer/spec

中写到的方法避免无效交易

Not every bitcoin wallet lets you choose which address bitcoins come from when you make a payment, and Omni transactions must all come from the address which holds the Mastercoins being used. If a bitcoin wallet contains bitcoins stored in multiple addresses, the user (or Omni Protocol software) must first ensure that the address which is going to send the Omni transaction has sufficient balance in bitcoins to create the transaction. Then, the Omni-related transaction can be sent successfully from that address.

Wallets which do not allow you to consolidate to one address and send from that address (such as online web wallet providers) will not work for Omni unless they are modified to do so. For this reason, attempting to purchase Mastercoins from an online web wallet will likely result in the permanent loss of those Mastercoins.

Other than for these hosted wallets, a bitcoin address can also be treated as an Omni address, capable of storing and using any Omni Protocol currency.