1inch Finds Vulnerability in Address Generating Tool Profanity

Several 1inch contributors recently discovered a vulnerability in Profanity. The Ethereum-based vanity address generating tool is one of the most popular names on the network.

Usually, Ethereum users create wallets by calculating a hash of a public key extracted from a random private key. While the addresses look random, generating more of them can reduce their randomness.

The network is filled with tools that let users create millions of addresses in a second. Profanity is one such tool that caught 1inch contributors’ eye earlier this year. Since the tool used a 32-bit vector to create 256-bit private keys, it was suspected of being unsafe.

Here is a quick overview of how Profanity operates:-

1. Randomly choose one of four billion seed private keys
2. Expand them to two million private keys
3. Generate public keys from the private keys
4. Repeatedly increase them until the desired vanity address is reached 

A bunch of 1inch developers believed that recomputing every vanity address by reseeding the initial four billion vectors was possible. The process needed months and thousands of GPUs to calculate the 6-7 character-long addresses.

Two months ago, one of the 1inch contributors got a message regarding suspicious activity on 1inch deployer wallets. At least five deployers from different projects were confirmed to have won the same airdrop.

Suspiciously, the funds were also transferred to one wallet. This raised concerns about a hack, and 1inch developers started investigating it. Their search ended a couple of weeks ago after discovering that it is possible to turn back to the initial seed keys more efficiently than explained above.

Here is how it can be done:-

1. Choose a public key from the vanity address
2. Expand it to two million public keys
3. Repeatedly increase them before reaching the seed public key

The contributors kept digging and found that Profanity did not develop the richest vanity addresses on several networks. It means that many of the Profanity wallets were breached secretly. 

The team is trying to figure out the breached wallets; however, it is a severely challenging task. One thing remains certain: over tens of millions of dollars in crypto could have already been stolen. The only good thing about this is that the proofs of the breaches are available on-chain.