The Analysis of the Atomicals Market User Asset Loss

Summary

On 2023-11-21, the Atomicals Market trading platform experienced users' asset loss incident that has thrown Atomicals Protocol and Atomicals Market, into a storm recently. A series of questions about the ARC-20 token have sparked widespread discussion and skepticism.

Atomicals Protocol & Atomicals Market

Atomicals Market is the trading marketplace for ARC-20, it applies Atomicals Protocol to trade ARC-20 (Note: Atomicals Market and Atomicals Protocol do not belong to the same company). Atomicals Market issued a post on the 21st stating that a PBST flaw was discovered in its trading process based on Atomicals Protocol, causing users to experience losses when trading atom tokens However, Atomicals Protocol issued a post on the 24th to counter Atomicals Market's comments and pointed out that the cause of the problem was Atomicals Market's negligence in using SIGHASH_NONE signatures in transactions, putting its users at risk. They stated that it had warned Atomicals Market that it should NOT use SIGHASH_NONE for signatures (it is worth noting that a similar situation does not appear to have occurred with SatsX, which is also an Atomicals trading platform). Upon analysis, the root cause of the users' asset loss was found to be Atomicals Market's incorrect use of SIGHASH_NONE (TX:1623bf2997cde779dd9e0e2c54b5f7f196f36826dcb689e41acd7fff27ec5c93) in the PSBT.

Preliminary knowledge

Before we go any further in analyzing why things are happening, some preparatory knowledge is needed, and that's because BTC doesn't use the same account model as Ethereum.

UTXO

A Bitcoin Unspent Transaction Output (UTXO) represents a specific segment of bitcoin ownership. Unlike traditional systems which utilize accounts and balances, Bitcoin operates with these individual bitcoin segments. Each UTXO is defined by a particular value, representing the distinct portions of bitcoin that are transferred in transactions. In the process of a transaction, a UTXO is consumed and ceases to exist. Consequently, this action generates one or more new UTXOs. The collective set of these UTXOs, known as the UTXO set, is maintained and updated by all network nodes. This occurs each time a new block processes transactions that generate and extinguish UTXOs. The UTXO set plays a critical role in enabling nodes to independently confirm the legitimacy of transactions and the bitcoins they aim to spend.

PSBT

A Partially Signed Bitcoin Transaction (PSBT) is a protocol in the Bitcoin ecosystem designed to enhance the ease of transferring unsigned transactions, enabling multiple participants to concurrently sign a single transaction. PSBTs (Partially Signed Bitcoin Transactions) offer utility across numerous scenarios. Consider the creation of a CoinJoin transaction involving three individuals. In this process, each of the three participants sends a message to a central coordinator. This message includes details of the UTXOs (Unspent Transaction Outputs) they wish to include in the CoinJoin. Additionally, every participant specifies the addresses to which their share of bitcoin should be returned after the CoinJoin transaction is completed.

What's the problem?

Atomicals Protocol mentioned performing the PBST swap securely requires the seller to sign 2nd input containing the ARC20 Atomical and 2nd output to receive the payment amount. The seller needs to sign with SIGHASH_SINGLE | ANYONECANPAY allows the buyer to later add their input for funding and their receive address for the purchased ARC20 tokens. Then, Atomicals Market does not use SIGHASH_SINGLE in a swap, but SIGHASH_NONE. We can look at the difference between NONE and SINGLE: Since, Atomicals Market uses NONE, just signing an INPUT means that only the number of tokens sold is verified. And no signature was applied to the OUTPUT, meaning that no verification was applied to the tokens received. As a result, malicious users can buy tokens from users without paying for them.

Lost

33,000 $ATOM

Follow-up

Atomicals Market Promises to Compensate Users for Losses.

Recommendation

The project owner should have an in-depth study of the protocols it relies on, and the product needs to be adequately tested and audited, paying attention to the recommendations from the protocols and security organizations.

About MetaTrust Labs

MetaTrust Labs is a leading provider of Web3 AI security tools and code auditing services incubated at Nanyang Technological University, Singapore. We provide advanced AI solutions that empower developers and project stakeholders to protect Web3 applications and smart contracts. At MetaTrust Labs, we are committed to protecting the Web3 space so that builders can innovate with confidence and reliability.

Website: https://metatrust.io/

Twitter: https://twitter.com/MetatrustLabs