CVE-2022-25335
📋 TL;DR
CVE-2022-25335 is an access control vulnerability in RigoBlock Dragos smart contracts where the setMultipleAllowances function lacks the onlyOwner modifier, allowing unauthorized users to manipulate token allowances. This enables attackers to transfer tokens without proper authorization, affecting all users interacting with vulnerable RigoBlock Dragos contracts. The vulnerability was actively exploited in February 2022 before being publicly disclosed.
💻 Affected Systems
- RigoBlock Dragos
📦 What is this software?
Drago by Rigoblock
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of all tokens controlled by vulnerable contracts through unauthorized allowance manipulation and subsequent transfers.
Likely Case
Unauthorized token transfers resulting in financial losses for contract users and token holders.
If Mitigated
No impact if proper access controls are implemented and onlyOwner modifier is enforced.
🎯 Exploit Status
Exploited in the wild in February 2022. The vulnerability allows any Ethereum address to call the vulnerable function without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available until major protocol upgrade
Vendor Advisory: https://twitter.com/RigoBlock/status/1494351180713050116
Restart Required: No
Instructions:
No immediate patch available. Users should migrate to new contracts once protocol upgrade is deployed. Monitor RigoBlock announcements for upgrade schedule.
🔧 Temporary Workarounds
Contract Migration
allDeploy new smart contracts with proper access controls and migrate all tokens and users
Not applicable - requires smart contract development and deployment
🧯 If You Can't Patch
- Monitor contract interactions for unauthorized setMultipleAllowances calls
- Implement additional off-chain validation for token transfers
🔍 How to Verify
Check if Vulnerable:
Check if deployed contract at address 0x876b9ebd725d1fa0b879fcee12560a6453b51dc8 has the onlyOwner modifier on setMultipleAllowances functionCheck Version:
Not applicable - check contract bytecode or source code verification on EtherscanVerify Fix Applied:
Verify new contract code includes onlyOwner modifier on setMultipleAllowances function📡 Detection & Monitoring
Log Indicators:
- Unauthorized calls to setMultipleAllowances function
- Unexpected token allowance changes
Network Indicators:
- Transactions calling setMultipleAllowances from non-owner addresses
- Suspicious token transfer patterns following allowance changes
SIEM Query:
Not applicable - blockchain transactions are public and can be monitored via blockchain explorers🔗 References
- https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8
- https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1f
- https://raw.globalsecuritydatabase.org/GSD-2022-1000077
- https://twitter.com/RigoBlock/status/1494351180713050116
- https://twitter.com/danielvf/status/1494317265835147272
- https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8
- https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1f
- https://raw.globalsecuritydatabase.org/GSD-2022-1000077
- https://twitter.com/RigoBlock/status/1494351180713050116
- https://twitter.com/danielvf/status/1494317265835147272
