Metamask Pulls Validators as Meager ETH Theft Sounds Big Alarm

Ethereum validators generally put up 32 $ETH, but Metamask says its staking operation is non-custodial and it doesn’t control customers’ withdrawal keys. Those keys are what allow the underlying stake to be withdrawn. An attacker able to tamper with validator settings, therefore, wouldn’t automatically hold the keys to the vault. Kaden’s onchain reconstruction instead points to the tip jar.

He reported that 19 Metamask validators won block rewards and payments, but 18 went to the wrong fee-recipient address. The address had been funded through the ether mixing service Tornado Cash, and the diverted payments totaled about 0.36 $ETH. Another reconstruction traced the activity to roughly four and a half hours on Sept. 30. It’s a tiny take followed by a very large alarm bell.

Why Metamask Went for Broke on Validator Exits

Changing the fee recipient can reroute a validator’s block tips without moving its 32 $ETH stake. The trouble starts if an attacker obtains something more powerful, such as validator signing keys.

Those keys can’t simply withdraw the stake, but they can potentially make proof-of-stake (PoS) validators commit offenses punishable by Ethereum’s slashing system. Slashing destroys part of the validator’s stake and removes it from service. Kaden said three exploited validators had not yet exited when he posted his analysis, and estimated about 821 potentially affected validators remained active.