Pinned post
1/
we found a bug in the Aptos Move VM that put up to $70B at systemic risk. type confusion at the execution layer. a ~90% success rate across hundreds of simulated runs on a 30+ validator cluster. cost to build the attack infrastructure: $3,000.
Conducted by @kemmio , to our knowledge this is the first public research that showcases how to land a sophisticated multi-block attack in real-world environments. It includes mempool feng shui, block production specifics and about a dozen of other primitives and tricks chained to get to near-perfect exploitation results.
Nonetheless, Aptos called it "extremely low exploitability."
[hexens.io/research/aptos…]
we found a bug in the Aptos Move VM that put up to $70B at systemic risk. type confusion at the execution layer. a ~90% success rate across hundreds of simulated runs on a 30+ validator cluster. cost to build the attack infrastructure: $3,000.
Conducted by @kemmio , to our knowledge this is the first public research that showcases how to land a sophisticated multi-block attack in real-world environments. It includes mempool feng shui, block production specifics and about a dozen of other primitives and tricks chained to get to near-perfect exploitation results.
Nonetheless, Aptos called it "extremely low exploitability."
[hexens.io/research/aptos…]
hexens.io Arbitrary Struct Hijack in Aptos Move VM A stale type-tag cache in the Aptos Move VM enables storage-level type confusion, letting an attacker hijack and overwrite arbitrary on-chain structs — disclosed by Hexens. 
