Squads Warns Users of Address Poisoning Threat in Solana Ecosystem

Squads has raised concerns over a fraudulent address poisoning scheme targeting its multisig user community on the Solana blockchain. Although no funds have been compromised yet, the situation poses a significant risk that demands attention.

On a recent Monday, Squads, recognized as the premier multisig platform within the Solana network, alerted users about an unexpected security threat. The platform highlighted the presence of an ongoing address poisoning attack aimed at its clientele. While there have been no reports of lost funds to date, the potential for harm is increasing.

TRUSTED PARTNER

4.9 ★★★★☆

Review and Opinions →

🔥 100% Up to 500$

1 Bonus + 200 Spin 🏆

Open an account

The malicious actors behind this scheme are leveraging how Solana presents public on-chain data. As every public key and its corresponding accounts are openly accessible, these attackers are manipulating the ecosystem to create counterfeit multisig accounts that mimic actual Squads users. These deceptive accounts are then displayed within the Squads user interface, causing confusion.

This attack strategy is both clever and insidious. It operates without requiring a breach of protocol or access to private keys. Instead, it hinges on users potentially misdirecting their focus just once. As outlined by the @multisig account on X, perpetrators are generating public keys that resemble the initial and final characters of authentic Squads vault addresses. This tactic makes the fake accounts appear genuine at first glance, enticing users to mistakenly send funds to an account controlled by an attacker or approve unauthorized transactions.

Although address poisoning is not a novel scheme, its application within the context of multisig accounts introduces a unique challenge. Unlike typical cases where a wallet history is meddled with via fictitious transactions, this attack directly integrates counterfeit multisig accounts into users’ Squad lists, making them seem legitimate.

Squads provided a clear assessment of the threat. It clarified that the attacker lacks the capability to execute transactions, manipulate existing multisig accounts, or transfer funds independently without user intervention. The essence of this issue, as described by @multisig, lies in it being a social engineering endeavor focused on the user interface.

This distinction is essential since social engineering has historically led to more financial losses than standard hacking exploits. Following the revelation of this threat, Squads acted promptly, rolling out updates to enhance user interface security within just a couple of hours. Notably, a notification warning users about the attack was implemented alongside alerts for any unfamiliar multisig accounts.

TRUSTED PARTNER

4.4 ★★★★☆

Review and Opinions →

🔥 100% up to 1 BTC

180 Free Spins 🏆

Open an account

In the coming days, @multisig confirmed that a whitelist feature would be launched, placing new multisig accounts in a pending state that will require manual verification before they are visible to users. This measure aims to mitigate the attack vector at the user interface level, ensuring added security.

To help users navigate the situation, Squads outlined four critical steps. First, they advised users to disregard any multisig accounts they did not personally create or were not added to by their team. Second, users should avoid validating authenticity solely based on the first and last characters of wallet addresses, as this partial verification is what attackers exploit. Third, they recommended confirming any suspicious activity with teammates before signing off on any transactions. Lastly, Squads urged users to set their genuine accounts as default, which can be accomplished through the settings menu, making it easier to identify imposters.

In response to the growing threat landscape, Squads is developing tools to assist in detecting counterfeit addresses directly within its platform. The team has committed to providing ongoing updates via X as they implement further security measures.