Executive brief
The Ethereum Name Service (ENS) is a decentralized domain naming system used to map human-readable names to blockchain addresses. A vulnerability in the ENS registry allowed a previous domain owner to secretly set a "trapdoor" that would let them reclaim ownership of the domain after transferring it to another party, without the new owner's knowledge or consent. This undermines trust in domain ownership transfers and could result in loss of control over valuable DNS-like assets.
Technical details
The vulnerability is an authorization bypass (CWE-285) in the ENS registry smart contract that failed to properly validate ownership restrictions during domain transfers. A domain owner could set a hidden trapdoor mechanism that persisted after transferring the domain, allowing them to later regain control without the new owner's awareness or consent. The attack requires only that a malicious actor originally own the domain; no additional authentication or network access beyond standard blockchain transaction capabilities is needed. An attacker can completely hijack a transferred domain after the fact. A patch was deployed via a new ENS registry contract at address 0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e, and affected users should migrate away from the old registrar.
Affected products
- ENS Domains ENS < 0.4.0
Timeline
- 2020-01-30: disclosed
- 2020-01-30: patched: New registry deployment at 0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e