Coinbase Wallet Exposed to Attackers Due to ‘Red Pill’ Flaw, Causing Security Concerns

Vulnerability found in Coinbase Wallet and other decentralized Crypto Apps, allowing malicious smart contract behavior to evade security features through Red Pill attacks.

Coinbase is a top crypto exchange that enables users to store, manage, and purchase ERC-20 Tokens, Bitcoin & Ethereum through its popular wallet app. ZenGo discovered the Red Pill attack exploiting security flaws shared by Coinbase and other cryptocurrency wallet providers.

Transaction simulation is a common security feature in Web3 platforms that uses sandbox emulation to anticipate the results of cryptocurrency transactions before they are executed. Its main purpose is to prevent cryptocurrency scams and theft by allowing users to test and preview their transactions before initiating them.

ZenGo identified a technique called „red pill attack“ that exploits transaction simulators and enables the theft of cryptocurrency. The attack relies on the malware identifying that it is operating in a simulation, allowing it to deceive anti-malware solutions and reveal its malicious intent only when executed in a real environment, according to ZenGo’s research blog.

Smart contracts can also be exploited by threat actors for malicious purposes, such as stealing cryptocurrency that has been sent or draining a wallet of its assets.

Distinguishing between malicious and legitimate contract signing requests is difficult, posing a challenge for cryptocurrency holders trying to navigate potential dangers.

The six cryptocurrency wallet apps that were found to be vulnerable to „red pill attacks“ by ZenGo Wallet are Coinbase wallet, Rabby wallet, Blowfish, PocketUniverse, Fire Extension, and an unnamed extension that has yet to address the issue.

Following the report from ZenGo Wallet, all of the mentioned vendors, except for one unnamed extension, have implemented fixes on their transaction simulation to address the vulnerability.

To prevent the use of vulnerable variables as „red pills“ in malicious contracts, the fix for this attack is to stop using arbitrary values for such variables.