Critical Vulnerability in Sign-In With Bitcoin (SIWB) used to Attack Odin.fun - Learnings and Discussion

[josephgranata]

Robin,

So nice to hear from you, and to know that you are leading now DFINITY’s security team. I worked with you in 2021, I was based in California at the time.

Some weeks ago I requested what you and your team have finally provided, a set of security best practices to prevent this kind of security hacks from occurring in the first place.

I will add a summary of your response to the thread I started about it here:

Let's Learn from the Odin.fun Hack - Preventing Attack Vectors

Ladies and Gentlemen, Some bad news Odin.fun the very successful memecoin project that uses Bitcoin as the main medium of payment, which uses under the hood ICP’s excellent BTC infrastructure was hacked. This post is not to criticize in any way Bob Bodily, and his team, it is mainly to explore ATTACK VECTORS against an ICP Backend, or smart contract so that we who also build on the IC make sure our software is secure. One of the main cool features of Odin.fun is that people can use many login…

Have a wonderful day!

Joseph Hurtado
Founder Satoshi Notes
Founder Granata Consulting