ICON, the 23rd largest cryptocurrency on Coinmarketcap, had an unacceptable bug in its smart contract code, and the error permitted everyone to disable ICX token transfers. The issue was reported by at least two Reddit users and a Twitter user. ICON, which is often referred to as the “Korean Ethereum,” reacted quickly and assured everyone that the bug would be fixed.
On Friday, a Twitter user sounded the alarm about the ICX error:
https://twitter.com/wolfcryptogroup/status/1007764965338550272
Soon, the topic began trending on Reddit, with one of the threads reaching nearly 300 comments. Once the bug became known, users started to spam ICX’s Ethereum smart contract by exploiting the disable function.
Reddit user “ThrashSilence” explained the principle behind the error by commenting:
!= means NOT EQUAL
== means EQUAL
“In this case, the contract is enforcing that the wallet address is NOT equal to a specified one, when it should be equal. This allows any address except the contract creator to enable or disable token transfers for everyone.”
In other words, the flaw was possible only because of a typo that involved a single character.
It seems that the code was fixed but the error can still be viewed:
According to a Reddit user, the part of the code starting with the line 162 is a modifier that considers the thing in the parenthesis to check if it is allowed, when called, to run the code in the {} to enable/disable. But the code uses “!=” instead of “==,” which, in Solidity, means that instead of saying the message sender must be equal to the wallet address of creator of ICON, it says the message sender must “not equal” to the wallet address of the creator of ICON. It suggests that everyone except for the contract owner can use the modifier to enable or disable token transfers.
“Wow, I'm speechless. Like building a car and the only key that does not start the car is the one you give to the buyer,” commented another user.
After the bug became public, Binance temporarily suspended ICX deposits and withdrawals.
Commentators on Reddit were shocked to see that a startup with millions of US dollars did not properly invest in code testers. ICON’s market cap touches on $770 million, according to Coinmarketcap data.
The ICON team came with a prompt reaction:
“We have implemented a solution to mitigate further problems. Most importantly, this error in no way threatens the security of your ICX tokens. All the ERC20 ICX tokens are safe.”
ICX is currently trading at $1.98, down 4% in the last 24 hours.
This article appeared first on Cryptovest
