Ethereum (ETH) decentralized exchange protocol AirSwap’s developers announced that they have discovered a critical vulnerability in the system’s new smart contract.
AirSwap’s team announced its findings and a possible solution for all potentially affected users in a Medium post published on Sept. 13.
A limited vulnerability
Per the release, on Sept. 12 AirSwap’s development team found a vulnerability in a new smart contract, which has already been reverted to an older version in under 24 hours after the discovery. The exploit in question could have allowed an attacker to perform a swap without requiring a signature from a counterparty under certain conditions. The scope of the vulnerability is reportedly limited:
“The affected code was present in the AirSwap system for under 24 hours, and only affects some users of AirSwap Instant between midday September 11th and early morning of September 12th. We initially identified 20 vulnerable addresses matching this pattern and quickly reduced it to 10 accounts that are currently at risk.”
Only nine addresses are at risk
AirSwap notes that the exploitable smart contract was reverted immediately after the issue was detected and that neither the AirSwap Instant nor Trader products are affected by the vulnerability. The release also discloses the nine Ethereum addresses that used the exploitable functionality during that time period.
Only the owners of the nine addresses are required to take any action to prevent the loss of funds. More precisely, it is necessary that they revoke the authorization for the vulnerable smart contract by visiting the following link.
As Cointelegraph reported in mid-July, the Ethereum smart contract of 0x decentralized exchange protocol has been suspended after a vulnerability has been uncovered in its code.