Block 4041169 - Parity Multisig Public Init Hack

Data art from Ethereum block 4041169 (Parity Multisig Public Init Hack). A collaboration between generative artist HEX0x6C (digital layer coded in Processing) and visual artist Chiara Braidotti (hand drawing on top of) for a (forthcoming) Virtual Reality museum telling the history of Ethereum through art.

On July 18th 2017, at block 4,041,169, a hacker called the initWallet method of the Parity Multisign wallet of the Edgeless team. This method was meant to only be called at contract creation. In fact, the default visibility was public, which meant that anyone was free to call the initWallet on any multisig wallets. One of the functions of the initWallet was to assign the owner of the wallet to the sender of the transaction (the hacker in this case). Ten blocks later, the wallet was emptied. Roughly 10 hours later, the hacker repeated the process on the Swarm City and Aethernity wallets, robbing these teams of about 153,000 ether. There were plenty of vulnerable wallets which were not drained by the hacker. The nature of the bug was kept as secret as possible while the White Hat Group (the same group that stepped in during The DAO to rescue funds) drained the vulnerable wallets of all ether and ERC-20 to a safe location. These funds, around 377,000 ether, were later distributed to the rightful owners by the White Hat Group. A stronger smart contract audit process may have avoided this issue. Similarly, it might have been safer to design Solidity so that the default visibility of methods isn’t public (or that it must be explicitly specified in all cases). In the end, it was also the community and the users' fault for not catching such a simple (and in hindsight extremely obvious) flaw.