First Attack on ETHPoW: What Happened?
As previously warned, a replay attack has occurred on Ethereum's first Proof-of-Work blockchain—ETHPoW.
What is a Replay Attack?
A replay attack is a type of security breach where transactions executed on a Proof-of-Stake (PoS) chain are duplicated and replayed on a Proof-of-Work (PoW) blockchain (or vice versa). This attack can only occur if the two blockchains share the same chainID and transactions are conducted from the same wallet address with identical nonce values.
Before The Merge, developers of both Ethereum and EthereumPoW confirmed that the two blockchains would have different chainIDs. In the latest update from EthereumPoW post-Merge, several features were added, including a Network ID change to mitigate risks related to replay attacks.
How Did This Happen?
Despite EthereumPoW's preparations for potential worst-case scenarios, an incident still occurred. According to BlockSec, a blockchain security solutions firm, a hacker transferred 200 WETH from Gnosis Chain’s OmniBridge and replayed the same transaction on ETHPoW, extracting an additional 200 ETHW. Consequently, the balance in the smart contract deployed on ETHPoW was quickly depleted. BlockSec also mentioned that the root cause of the issue was the Gnosis Chain bridge’s failure to accurately verify chainID of cross-chain messages between PoW and PoS chains.
BlockSec: “The exploiter (0x82fae) first transferred 200 WETH through the OmniBridge of the Gnosis chain, and then replayed the same message on the PoW chain and got an extra 200 ETHW. As a result, the balance of the chain contract deployed on the PoW chain would be drained.”
— BlockSec (@BlockSecTeam) September 18, 2022
EthereumPoW's team confirmed that the attack originated from a bridge error rather than their blockchain, as EIP-155—a proposal developed by Vitalik Buterin in 2016 to protect against replay attacks—was implemented on EthereumPoW.
In response to BlockSec's tweet, Gnosis founder Martin Köppelmann clarified that their bridge on Gnosis and Ethereum was not affected. He noted that Gnosis had not announced support for the ETHPoW chain and did not see themselves as responsible for the attack.
Martin Köppelmann: “To be clear—the bridge on Gnosis Chain and Ethereum is in no way affected. We do not support the Eth-POW chain and do not see ourselves responsible for what is happening on that chain.”
— Martin Köppelmann (@koeppelmann) September 18, 2022
Martin also added that replaying transactions on the PoW chain could lead to users creating fake transactions from bridges to siphon funds on the EthereumPoW blockchain. Even if too many transactions occur and hit the daily limit of what a bridge can handle, transactions would continue the next day. Therefore, he suggested pausing bridges on the EthereumPoW blockchain to prevent such “looting” activities.
Following the news, the price of ETHW token plummeted to around $4.45, representing a nearly 90% drop within less than a day.
ETHW Price Chart Showing Decline After Attack News
Price chart of ETHW (1-hour timeframe) at 10 AM, September 19
