Franken Attack

If you are the attacker and you are reading this article, please pay attention to the “An offer of settlement to the attacker” section. Thank you!

The Exploit

On October 3 and October 10, 2022 an attacker attacked RayStake by spoofing a stake key in the payment address, causing the vending machine to send rewards of a specific stake key to the attacker’s address.

The following transactions were made to withdraw funds from RayStake:

• https://cardanoscan.io/transaction/85484a97ac2c7e9cb1bdbf97bf8b5e7e5f5869faf213b0787a070c381b73f83b?tab=utxo
• https://cardanoscan.io/transaction/8328b9875bc48998bafb8caf8fa3840771ceb732dabf720c62fc8e04c4a2a0ce?tab=utxo
• https://cardanoscan.io/transaction/f617360fa5a278c5515e6fbf0973e90964e4d8b3effd58e27e511afd38aa433f?tab=utxo
• https://cardanoscan.io/transaction/160bacf4a979af329742dc4c3abd086f178cb92fa9d0976e921672c76f96a0a8?tab=utxo
• https://cardanoscan.io/transaction/f4763c7f2383cbf867b41c405450be94adcc0fa58cbae1c3c8139db0564727a5?tab=utxo

Franken Address

This type of payment address with someone else’s stake key mixed in it is called a “franken address”. The essence of the name of the address says that it is made up of two different seed keys.

You can find more details in the video by Andrew Westberg: https://www.youtube.com/watch?v=KULzovfWn-M

Affected Funds

In the four transactions listed above, the attacker accessed a total of 5,554,113 XRAYs and 112 XDIAMONDs. He sold these funds through Minswap DEX and Sundaeswap for 412,253 ADA.

What we know about the attacker

The ADA received from the sale of the stolen funds is at two addresses:

• https://cardanoscan.io/address/addr1qx9tk5p6djdpvqs7jz7h6nna0h8muqg2vad2mwkgx9302zkujzs5x4mfpp7cm4mlzzatfh7em7fer7vsxfn5fvxqyeysakqz0t
• https://cardanoscan.io/address/addr1q826f7ct02yddvjgkas3rluj7ypx46tq00z3e4fp67p9qx2qlrv0ldu552q3tlrdy9flytth9kmwv3rvf39s8fdzx4xqd05e0z

Exploring the chain of inputs and outputs we found all the wallets involved in this attack:

• stake1u9spzsldtksx952l8wvlnzn3tg0nhgrwcns06rmnp0at6kqsqu5tc (875,515 ADA)
• stake1uywy7hh6u7vjf7z8q4d8lwknh3uz7vsrxltgx7ynljnp6rghsr6hr (65 ADA)
• stake1u9q03k8lk7229qg4l3kjz5lj94mjmdhxg3kycjcr5k3r2nqc3s0ep (109,922 ADA)
• stake1uyhlu6jdwpy08td36me03a4qxc2emx4ld4fmcx4smd2dx9ce52wcx (4,633,683 ADA)
• addr1vyzhn8qj85v5w4e6k7f5389cgz7svsyt933703sg83jq49skrcy4p (184 ADA)

It is worth paying attention to the wallet stake1uyhlu6jdwpy08td36me03a4qxc2emx4ld4fmcx4smd2dx9ce52wcx with 4,6M ADA (at time of publication Oct 15, 2022) because there were incoming transactions to addr1vyzhn8qj85v5w4e6k7f5389cgz7svsyt933703sg83jq49skrcy4p wallet from which the transactions from franken adresses were signed. Which indicates a direct link between the attacker and this wallet.

A list of such transactions:

• https://cardanoscan.io/transaction/d43a77d14fd4f2de80273fd15956732b814c8aafed15af93a99783b742b46bc0
• https://cardanoscan.io/transaction/3e358c83ea49d9362c3c361952eba643d25eb7b60d1d8c197037062675641083

An offer of settlement to the attacker

We value the culture of “white hat hackers” who help various information systems find vulnerabilities and fix them.

In view of this, we are willing to offer 20% of the 412,253 ADA you stole in exchange for closing this case.

We believe that 4,600,000 ADA of your funds is not worth a permanent criminal prosecution because of 412K ADA.

Especially since you left a lot of digital footprints that will help DPS Cyber Security keep you in their crosshairs.

Just send the 329,000 ADA (80%) you stole to addr1q9acqkgp6ah0xl6dt6gxtrmj8ee4ehnzfeq9rcuwrldalfsl94rky7hgymnt04zzmn696ksga7526ycypga0p0q5scfquhr65g and we will consider the deal closed.

What’s next

Affected funds (5.5M XRAY and 112 XDIAMOND) will be returned from Dev Fund to LP / XRAY Staking Program which will be reflected in the final tokenomics.

As RayStake moves into DEX mode (Stage 2), we’re announcing global changes to the XRAY token and tokenomics (spoiler: total cap will be 20% less)!

Stay tuned! And never give up!