Web3 security company Blowfish recently detected a pair of sophisticated Solana (SOL) transaction drainers capable of executing elusive bit-flip attacks.
The firm’s Feb. 9 analysis details how these drainers — dubbed aqua and vanish — can alter a condition in on-chain data post-transaction signature by the user’s private key.
These dangerous scripts lurking under the transactional radar are being peddled on the dark web, offering scammers a scam-as-a-service toolkit.
The Blowfish examination highlights the drainers’ adept use of the on-chain authority provided to decentralized apps (dapps), enabling them to switch from transaction facilitators to malicious account-draining entities.