Introduction to WalletConnect Phishing Risks

The SlowMist security team detected a security vulnerability on January 30, 2023, which could lead to phishing attacks through inappropriate use of WalletConnect on Web3 wallets. This vulnerability arises when the DApp Browser and WalletConnect are integrated into mobile wallet applications.

It was discovered that several Web3 wallets that enable WalletConnect support fail to limit the location of the transaction pop-up window from WalletConnect, resulting in signature requests appearing on any interface within the wallet.

As users switch from the DApp Browser interface to other wallet interfaces like Wallet and Discover, the WalletConnect connection persists, as the wallet aims to preserve the user experience and avoid repetitive authorizations. However, during this time, users may be susceptible to phishing attacks that capitalize on unexpected signature requests from malevolent DApps, which could potentially lead to the loss of their assets.

The dynamic demo GIF is as follows:

Once connected, the attackers send continuous and periodic malicious signature requests, such as blind signatures, authorization signatures, and transaction signatures for special smart contract protocols, including eth_sign (used as an example later).

If users decline an unsafe eth_sign request, the phishing site generates more malicious eth_sign signature pop-ups continuously, provided the user fails to close the wss connection in a timely manner. With continued wallet usage, users may mistakenly click the sign button, leading to asset loss.

The crux of this security issue is whether pop-up responses should automatically continue after users switch from the DApp Browser interface to other interfaces, particularly when dealing with sensitive operation requests. Automatically responding to pop-ups across interfaces can result in user errors.

This issue is guided by a security principle: wallets should not respond to pop-up requests from the DApp Browser after users switch to other interfaces once a WalletConnect connection has been established.

It is also noteworthy that although the same issue may occur when a mobile wallet app connects with a PC browser via WalletConnect, users in this scenario may be less susceptible to errors.

Interface switching after WalletConnect connection

The SlowMist security team tested 20 popular crypto wallet apps based on their high search volume and download count in the market.

Based on the test results in the above table, we found the following:

Discovery and Follow-up of WalletConnect Phishing Risks

The SlowMist security team initially detected the WalletConnect phishing risks on Trust Wallet and reported the issue through the Bugcrowd vulnerability submission platform. Trust Wallet expressed gratitude and confirmed that they would address the security issue in their next release.

It is worth noting that the absence of risk warnings for low-level signature functions, such as eth_sign (blind signatures), significantly heightens the phishing risks of WalletConnect.

However, disabling eth_sign alone cannot completely eliminate the risks (this article uses eth_sign merely as an example). Thus, we encourage more wallets to disable it. For instance, MetaMask, the wallet with the highest number of users, has disabled eth_sign by default in version V10.25.0 of the plug-in, released on February 10, 2023. Moreover, the mobile version of MetaMask from version 6.11, released on March 1, 2023, also defaults to not supporting eth_sign. Users must manually enable it in the settings to use 

It is worth mentioning that MetaMask version 6.11 and later includes URI request validation for DApps. When a DApp interacts with WalletConnect, a warning pop-up is displayed. However, this warning has the potential risk of being displayed infinitely, leading to a denial-of-service (DoS) attack.

Summary and Recommendations

For individual users, the main risks of using WalletConnect are related to “domain names” and “signatures.” This phishing method has been widely used by many malicious websites for phishing attacks, so users should remain highly vigilant when using it.

For wallet project teams, comprehensive security audits are necessary, with a focus on improving user interaction security and strengthening the “what you see is what you sign” mechanism to reduce the risk of phishing attacks. Some recommendations include:

Stay tuned for more phishing security risk analyses and alerts from the SlowMist Security team.

As a leading blockchain security company, SlowMist has been deeply involved in security audits for many years. Security audits not only provide users with peace of mind but are also an effective means to reduce the occurrence of attacks. Moreover, due to data silos, various institutions find it difficult to identify money laundering groups that operate across institutions, posing a significant challenge to anti-money laundering efforts. For project parties, it is crucial to timely block and prevent fund transfers to malicious addresses. MistTrack, the anti-money laundering tracking system, has accumulated more than 200 million address labels, enabling the identification of various wallet addresses of mainstream trading platforms worldwide. It includes over 1,000 address entities, over 100,000 threat intelligence data, and over 90 million risk addresses. Contact us to access the API if needed. Lastly, let us work together to make the blockchain ecosystem better.

Read more: https://slowmist.medium.com/slowmist-beware-of-walletconnect-phishing-risks-in-web3-wallets-229445fb79f1