The recent Bybit attack underscored significant security issues in the Ethereum Virtual Machine (EVM), showcasing vulnerabilities in multisig wallets and upgradable contracts. MultiversX proposes solutions to enhance security.
How the Bybit Attack Unfolded
The hacker executed a sophisticated scheme involving four key steps. First, they deployed a trojan contract and a backdoor contract. Next, they deceived multisig wallet signers into approving an ERC-20 transfer to the trojan contract. Instead of transferring tokens, the contract replaced the Safe multisig implementation with the attacker's backdoor contract. Finally, the hacker executed sweepETH and sweepERC20 functions, draining the wallet of ETH, mETH, stETH, and cmETH tokens.
Why EVM Security Remains a Concern
Sasu pointed out that EVM security flaws have persisted for years. DelegateCall and proxy-based upgrades introduce severe risks. These mechanisms create backdoors, making contracts vulnerable to exploitation. Many Layer 2 solutions rely on similar architectures, leaving billions at risk. Moreover, the reliance on multisig wallets further exacerbates security threats. Attackers often manipulate signers into approving malicious transactions, leading to multiple bridge hacks and substantial financial losses in the past. Despite these risks, the industry continues to prioritize EVM compatibility over fundamental security improvements.
How MultiversX Addresses These Issues
MultiversX introduces a more secure contract model. It allows contracts to be explicitly set as upgradable or non-upgradable, eliminating the risks associated with DelegateCall. Additionally, it features a transparent upgrade function that users can clearly understand before execution. Another key improvement is the wallet's ability to interpret transactions. Users receive a human-readable message outlining the exact transaction details before signing, preventing hidden malicious actions from being executed. Furthermore, MultiversX eliminates ERC-20 token standards and smart contract-based token transfers, employing a native asset system with atomic TransferAndExecute functions, enhancing security. On-chain guardians add another protective layer, linking wallets to cold storage for extra verification, ensuring users fully comprehend their transactions before signing, reducing the risk of deception.
The Bybit attack has renewed focus on EVM security issues. While traditional mechanisms remain vulnerable, projects like MultiversX offer new solutions that significantly enhance user protection.
