Web3 Security on 思安录 | Thinking's Security Notes

A Popular Solana Bot on GitHub Was a Wallet Thief: Supply Chain Attack Analysis

Thinking — Thu, 03 Jul 2025 00:00:00 +0000

Osiris Malicious Browser Extension Analysis: Download Link Hijacking Disguised as a Security Tool

Thinking — Wed, 28 May 2025 00:00:00 +0000

ReachMe.io Vulnerability: Saying Hi to CZ on a Budget

Thinking — Fri, 28 Mar 2025 00:00:00 +0000

Yesterday, while I was still sorting through APT attack materials, Brother Shan (@im23pds) suddenly rushed over to my desk, excited: “Thinking, I found an interesting project that CZ is using heavily — maybe we can say Hi to CZ for zero cost.” We quickly brainstormed several potential vulnerability points:

Hijacking CZ’s ReachMe account;
Changing CZ’s ReachMe settings;
Messaging CZ for free, bypassing the 1 BNB fee to send him a message.

About 10 minutes later, we discovered a vulnerability that allowed sending messages to any user on ReachMe.io at low cost. We immediately contacted the project team with detailed vulnerability verification. The project team quickly fixed the vulnerability and reached back out to us for retesting. Kudos to the ReachMe team for taking security seriously!

Additionally, the SlowMist Security Team was honoured to receive thanks from both CZ and the ReachMe project team.

LinkedIn Recruitment Phishing Analysis: A Targeted Attack Against Blockchain Engineers

Thinking — Sat, 15 Mar 2025 00:00:00 +0000

Celer Network cBridge Cross-Chain Bridge Incident Analysis: BGP Hijacking Attack

Thinking — Sat, 20 Aug 2022 00:00:00 +0000

Solana Blockchain Mass Theft Analysis: Slope Wallet Sentry Leaks Mnemonic Phrases

Thinking — Thu, 04 Aug 2022 00:00:00 +0000

MetaMask Browser Extension Wallet demonic Vulnerability Analysis

Thinking — Fri, 17 Jun 2022 00:00:00 +0000

On 16 June 2022, MetaMask (MM) officially disclosed a security issue discovered by a white-hat researcher, dubbed the demonic vulnerability. The vulnerability affects versions < 10.11.3. Given MM’s large user base and the number of wallets developed based on MM, the impact is significant — MM generously awarded the white-hat researcher a $50,000 bounty. After the team synced me on this vulnerability, I began analysing and reproducing it.

MetaMask Clickjacking Vulnerability Analysis: iframe Hijacking and Phishing Whitelist Bypass

Thinking — Tue, 14 Jun 2022 00:00:00 +0000

On 3 June 2022, MetaMask (MM) publicly disclosed a severe Clickjacking vulnerability discovered by a white-hat researcher. The impact: when a user’s MM extension wallet is unlocked and they visit a malicious site, the site can use an iframe tag to embed the unlocked MM wallet page, hide it, and then guide the user to click on what appears to be the website — while the actual interaction happens on the unlocked MM page — thereby stealing the user’s cryptocurrency or NFTs. Given MM’s large user base and the number of projects that fork MetaMask, we immediately began reproducing the vulnerability and searching for its impact on other forked projects after MM’s disclosure.

The SlowMist Security Team then notified affected project teams as much as possible and guided them through remediation. We are now publishing this Clickjacking vulnerability analysis to help future projects avoid the same pitfall.

Sky-High Fee Analysis: ethjs-util Floating-Point Data Processing Flaw

Thinking — Wed, 29 Sep 2021 00:00:00 +0000