News for hackers. Stuff that matters.

A comment on Social engineering scam that nearly cost me all of my ETH. Parent comment

Re:Social engineering scam that nearly cost me all of my ETH by labrador on Sunday February 13, 2022 @06:21PM (#30326617)
According to this talk about NFTs, an NFT can contain code and the execution of that code can be triggered to do unsafe things.

at 1:22:50 Smart contracts are just code, they’re software, there’s no reason they can’t be viruses or worms, the primary limitation is processing power. But, also, it’s a virus that someone can drop directly into your bankless bank account and just wait for you to activate it. And, yeah, that’s right, there’s no offer/confirmation step in sending tokens back and forth, someone who knows your wallet can just drop stuff right into it, so, like, pin that somewhere in your brain.

Line Goes Up – The Problem With NFTs

https://youtu.be/YQ_xWvX1n9g?t=4970

[ Parent | on HN ]
Re:Social engineering scam that nearly cost me all of my ETH by dlubarov on Sunday February 13, 2022 @07:54PM (#30327267)
FWIW it doesn't seem that's what happened in this case. It seems the NFT was just part of the attacker's ruse, where they told a story about some NFT staking dapp they launched. Then the malicious dapp asked for permission to transfer the victim's aWETH tokens. This is just part of the ERC-20 API, unrelated to NFTs.

While it's true that NFTs can be sent without permission and can contain code, users normally invoke contracts via (hopefully trusted) dapp websites, such as app.uniswap.org. Invoking code from an NFT I found in my wallet is possible, but not part of any normal/legitimate workflow that I'm aware of.

[ Parent | on HN ]