Skip to content

Commit 34e6e47

Browse files
mefai-devmefai-dev
committed
Add four.meme ERC-7702 delegation attack vector analysis
Security assessment of four.meme BSC token launchpad analyzing the ERC-7702 wallet delegation attack surface. Includes on-chain forensics with CrimeEnjoyer delegate contract decompilation and verification commands for all findings.
1 parent c8d86f6 commit 34e6e47

File tree

1 file changed

+259
-0
lines changed

1 file changed

+259
-0
lines changed

‎audits/FOUR-MEME-ERC7702-SECURITY-REPORT.md‎

Lines changed: 259 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,259 @@
1+
# four.meme Security Report: ERC-7702 Delegation Attack Vector Analysis
2+
3+
A security assessment of [four.meme](https://four.meme/) BSC token launchpad analyzing the ERC-7702 wallet delegation attack surface and identifying areas for security improvement.
4+
5+
## Background
6+
7+
Multiple four.meme users reported complete wallet drainage after interacting with the platform. On-chain forensic investigation traced the attacks to the CrimeEnjoyer ERC-7702 drainer family which has compromised over 450,000 wallets globally.
8+
9+
This report documents the security architecture of four.meme and identifies areas where additional protections could reduce user exposure to ERC-7702 delegation attacks.
10+
11+
## Key Findings
12+
13+
### 1. No Subresource Integrity (SRI) on Any Script
14+
15+
four.meme loads 9+ JavaScript bundles (2MB+ total) without integrity verification.
16+
17+
**Verify yourself:**
18+
```bash
19+
curl -s https://four.meme/ | grep 'integrity='
20+
# Returns nothing. Zero SRI tags.
21+
```
22+
23+
Without SRI a CDN compromise or network-level attacker can modify any JavaScript file silently. The browser executes modified code without detecting the change.
24+
25+
### 2. No Content Security Policy (CSP)
26+
27+
```bash
28+
curl -sI https://four.meme/ | grep -i content-security-policy
29+
# Returns nothing. No CSP header.
30+
```
31+
32+
No CSP means injected JavaScript runs with full page privilleges. No restrictions on inline scripts. No restrictions on eval(). No domain whitelisting.
33+
34+
### 3. Wildcard CORS Configuration
35+
36+
```bash
37+
curl -sI -H "Origin: https://evil.com" https://four.meme/ | grep access-control
38+
```
39+
```
40+
access-control-allow-origin: *
41+
access-control-allow-credentials: true
42+
access-control-allow-methods: PUT, GET, POST, OPTIONS
43+
```
44+
45+
Any website can make authenticated cross-origin requests to four.meme API. A phishing page hosted on any domain can interact with four.meme's backend using the victim's credentials.
46+
47+
### 4. ERC-7702 Signing Functions Pre-loaded
48+
49+
The viem wallet library loaded on all token pages exposes ERC-7702 signing capability:
50+
51+
```bash
52+
curl -s https://four.meme/_next/static/chunks/6802-eba0a6daffa29dc6.js | grep -o 'signAuthorization'
53+
# Returns: signAuthorization
54+
55+
curl -s https://four.meme/_next/static/chunks/6802-eba0a6daffa29dc6.js | grep -o 'prepareAuthorization'
56+
# Returns: prepareAuthorization
57+
58+
curl -s https://four.meme/_next/static/chunks/6802-eba0a6daffa29dc6.js | grep -o 'authorizationList'
59+
# Returns: authorizationList
60+
```
61+
62+
The `_app` bundle also contains the transaction type serializer that automaticaly converts transactions with `authorizationList` to ERC-7702 type (0x04):
63+
64+
```javascript
65+
// From _app-04e1e4a14ed5708f.js (viem library code)
66+
// Transaction type detection:
67+
if(void 0!==e.authorizationList) return "eip7702";
68+
69+
// Transaction type mapping:
70+
{legacy:"0x0", eip2930:"0x1", eip1559:"0x2", eip4844:"0x3", eip7702:"0x4"}
71+
72+
// Serialization: if authorizationList exists it gets included in the signed transaction
73+
void 0!==e.authorizationList&&(t.authorizationList=e.authorizationList.map(...))
74+
```
75+
76+
four.meme's own page code (create-token.js, token_address.js, index.js) has **zero referrences** to signAuthorization or authorizationList. The functions exist only in the viem library. However because they are loaded in the page context any injected code can call them directly.
77+
78+
### 5. Backend API Returns Transaction Parameters
79+
80+
The token purchase flow relies on a backend API that returns transaction data:
81+
82+
```
83+
POST /v1/private/token/presale/buy
84+
Response: { buyArg: "...", signature: "..." }
85+
```
86+
87+
The frontend uses this response directly in contract calls. If the API response is intercepted or the API server is compromised the returned data could be modified to include malicous parameters.
88+
89+
### 6. Unverified Smart Contracts
90+
91+
four.meme's main contract `0x5c952063c7fc8610FFDB798152D69F0B9550762b` uses an EIP-1967 proxy pattern. The implementation contract is not verified on BscScan. Users canot audit what code their transactions execute.
92+
93+
### 7. Active Phishing Domains
94+
95+
Multiple confusingly similar domains are active:
96+
97+
| Domain | Status | Threat |
98+
|--------|--------|--------|
99+
| 4meme.com | Active | Loads FingerprintJS and redirects users |
100+
| fourmeme.xyz | Active | Redirects to /lander (classic scam pattern) |
101+
| fourmeme.com | Active | Parked with custom HTML |
102+
| four-meme.io | Active | Registered |
103+
104+
Verify:
105+
```bash
106+
dig 4meme.com +short
107+
# Returns: 103.224.212.205
108+
109+
curl -s https://4meme.com/ | head -5
110+
# Shows FingerprintJS loading
111+
```
112+
113+
## On-Chain Evidence
114+
115+
### Victim Wallet Verification
116+
117+
```bash
118+
# Check if a wallet has been compromised by ERC-7702 delegation
119+
curl -s -X POST https://bsc-dataseed1.binance.org \
120+
-H "Content-Type: application/json" \
121+
-d '{"jsonrpc":"2.0","method":"eth_getCode",
122+
"params":["0x8cbf7a53af6b88abb07ba481ac66d73a99985878","latest"],"id":1}'
123+
```
124+
125+
**Response:**
126+
```
127+
0xef010091c478e3a87626be374e0c29338ad68f38556e2c
128+
```
129+
130+
Breakdown:
131+
- `0xef01` = ERC-7702 delegation prefix (normal wallets return `0x`)
132+
- `0091c478e3a87626be374e0c29338ad68f38556e2c` = delegate contract address
133+
134+
### CrimeEnjoyer Drainer Contract
135+
136+
**Delegate:** `0x91c478e3a87626be374e0c29338ad68f38556e2c` (2727 bytes)
137+
138+
Decompiled function table:
139+
140+
| Function | Auth Required | Purpose |
141+
|----------|--------------|---------|
142+
| receive() | None | Auto-forwards incoming BNB to controller |
143+
| fallback() | None | Same as receive. Backup sweep |
144+
| multicall(Call[]) | tx.origin == owner | Executes arbitrary calls from victim wallet |
145+
| selfdestruct() | tx.origin == owner | Destroys evidence. Sends remaining funds |
146+
| name() | None | Returns "wee". CrimeEnjoyer fingerprint |
147+
148+
Controller address `0xa7bff280ba6308ebc8fa3f5a1fa1b455aa57e972` is hardcoded 5 times in bytecode.
149+
150+
### Controller Activity
151+
152+
```bash
153+
curl -s -X POST https://bsc-dataseed1.binance.org \
154+
-H "Content-Type: application/json" \
155+
-d '{"jsonrpc":"2.0","method":"eth_getTransactionCount",
156+
"params":["0xa7bff280ba6308ebc8fa3f5a1fa1b455aa57e972","latest"],"id":1}'
157+
```
158+
159+
**Nonce: 3836+** (approximately 1 transaction every 68 seconds, still activley draining wallets)
160+
161+
## How the Attack Works
162+
163+
```
164+
User visits four.meme token page
165+
|
166+
[Cloudflare CDN serves JS] <-- No SRI = modifiable in transit
167+
|
168+
[Browser loads viem with signAuthorization()]
169+
|
170+
[User clicks Buy/Sell/Approve]
171+
|
172+
[If JS was modified: authorizationList injected into transaction]
173+
|
174+
[viem automaticaly sets type to 0x04 (ERC-7702)]
175+
|
176+
[MetaMask shows normal-looking transaction]
177+
|
178+
[User confirms]
179+
|
180+
[Wallet delegated to CrimeEnjoyer]
181+
|
182+
[All funds drained. All future deposits auto-forwarded]
183+
```
184+
185+
The chain of conditions: **No SRI + No CSP + viem signAuthorization loaded in page context** creates a surface that could be exploited if any code injection occurs.
186+
187+
## Security Observations
188+
189+
four.meme's own code does NOT call signAuthorization or construct authorizationList. However the security gaps identified below directly contribute to the conditions that make ERC-7702 delegation attacks possible against four.meme users. These issues should be addressed urgently to prevent further wallet compromises:
190+
191+
1. **No SRI** on script tags. Adding integrity hashes would help detect unauthorized CDN modifications
192+
2. **No CSP** header. A content security policy would limit the impact of any code injection
193+
3. **Wildcard CORS** configuration. Restricting origins would reduce cross-origin attack surface
194+
4. **No ERC-7702 warnings** for users. A delegation check could alert users to compromised wallets
195+
5. **No wallet health check** (eth_getCode). Detecting active delegations at connect time would protect users
196+
6. **Unverified contracts** on BscScan. Verification would allow the community to audit the code
197+
198+
## Recommendations for four.meme
199+
200+
### Immediate Actions
201+
1. Add SRI hashes to all `<script>` tags
202+
2. Implement strict CSP header: `script-src 'self'; default-src 'self'`
203+
3. Restrict CORS to `https://four.meme` only
204+
4. Tree-shake viem to remove unused signAuthorization from bundles
205+
206+
### Short Term
207+
5. Add wallet health check: call `eth_getCode` on connected wallet and warn if `0xef01` prefix detected
208+
6. Report phishing domains (4meme.com, fourmeme.xyz) to registrars
209+
7. Verify all smart contracts on BscScan
210+
8. Display ERC-7702 risk warning banner for BSC users
211+
212+
### Long Term
213+
9. Sign API responses to prevent MITM modificaton
214+
10. Implement certificate transparency monitoring
215+
11. Set up phishing domain monitoring service
216+
217+
## How to Check Your Wallet
218+
219+
```javascript
220+
// Run in browser console or Node.js
221+
const provider = new ethers.JsonRpcProvider("https://bsc-dataseed1.binance.org");
222+
const code = await provider.getCode("YOUR_WALLET_ADDRESS");
223+
224+
if (code === "0x") {
225+
console.log("SAFE: Normal wallet");
226+
} else if (code.startsWith("0xef01")) {
227+
console.log("COMPROMISED: ERC-7702 delegation active!");
228+
console.log("Delegate:", "0x" + code.slice(6));
229+
console.log("DO NOT send any funds to this wallet!");
230+
} else {
231+
console.log("This is a smart contract, not an EOA");
232+
}
233+
```
234+
235+
## Methodology
236+
237+
- JavaScript bundle analysis (2.3MB+ across 20+ files)
238+
- Direct BSC RPC calls (eth_getCode, eth_getTransactionCount, eth_getBalance)
239+
- CrimeEnjoyer delegate contract reverse engineering
240+
- DNS and certificate transparncy analysis
241+
- HTTP security header verification
242+
- Build manifest and dependency chain analysis
243+
- Phishing domain enumeration and verification
244+
245+
## Disclaimer
246+
247+
This report was produced for defensive security research purposes. No exploitation was performed. All on-chain data is publicly accesible. All web security tests used standard HTTP requests to public endpoints. This report is intended to support four.meme in strengthening its security posture and helping users stay protected against ERC-7702 delegation attacks.
248+
249+
## Credits
250+
251+
MEFAI Security Research Team
252+
Report Date: April 4, 2026
253+
254+
## References
255+
256+
- [EIP-7702: Set EOA account code](https://eips.ethereum.org/EIPS/eip-7702)
257+
- [BSC Pascal Hardfork (EIP-7702 support)](https://www.bnbchain.org/en/blog/bsc-pascal-hardfork)
258+
- [Wintermute: ERC-7702 Delegation Analysis](https://wintermute.com)
259+
- [MetaMask Security Advisory: ERC-7702 Phishing](https://metamask.io/news/)

0 commit comments

Comments
 (0)
⚡