I tricked Etherscan to advertise my YouTube channel.
There are now millions of my transactions on the blockchain with new ones being created
every second.
What I did is actually pretty simple.
Now, whenever you buy an NFT on OpenSea, it will show up as Junion Youtube.
Canceling a listing will tell you to subscribe.
Swapping tokens is now called Swap With Junion.
And the list goes on.
I own some of the most popular functions on Ethereum, and nobody can stop me… well except
for Etherscan itself, and I'm guessing they’re gonna patch this real soon.
Because people got confused.
Their wallets showed random transactions completely unrelated to what they were doing.
Don't worry, I didn't hack your wallets.
In this video, I want to explain what I did and how I did it.
But first, I need to give some context.
This video was initially supposed to be about this interesting function I noticed called
buy and free.
It's the most popular function on Ethereum, though you’ve probably never used it.
The reason why this function is so popular has to do with the way functions are hashed
and also how Etherscan handles them.
I had a theory for how this worked, but I wanted to test it.
And by doing so, I accidentally realized I could change some existing functions to anything
I wanted.
Let me explain.
Ethereum is made up of a bunch of smart contracts, which have functions that do stuff.
For example, OpenSea is a contract, and cancel is a function.
Under the hood, Ethereum reads this function by its signature.
To do this, the compiler takes the function name and arguments, hashes it, and takes the
first 4 bytes.
The word cancel is not actually stored on the blockchain.
By the way, this is why buy and free is so popular.
Its signature turns out to be 8 zeroes.
Zero bytes are cheaper.
So over the course of thousands of calls, this tiny gas saving can add up to a lot of
money.
But why is Etherscan displaying this function as buy and free?
How does it go from 8 zeroes to the function name?
Cryptographic hashes are impossible to reverse, and multiple function names can share the
same signature.
In fact, on Snowtrace, calling 8 zeroes will show up as ROOT.
This made me suspect that Etherscan is somehow logging previous functions.
Etherscan has a tool where developers can verify their smart contracts.
You submit the human-readable functions and if it matches the bytecode, it publishes for
all to see.
In fact, 7 months ago, I noticed that SushiSwap was unverified on Snowtrace.
So I copied the code and verified it myself but added a bit of extra stuff.
However, this isn't the way I did it.
That's because the contracts were already verified, so I couldn't publish my own over
it.
My theory was that on verification, Etherscan stores these function names and their signature.
Then, when you send an unknown signature it already has, it will just trace it back to
what it knows.
So this explains why Etherscan and Snowtrace have different names for the same function.
On Ethereum, the first person to verify the zero function must have called it buy and
free.
Meanwhile, the first Snowtrace was root.
I wanted to test this theory.
I remembered that Matcha always showed up unverified.
If I could somehow get that signature and verify a contract with it, I could see if
this was true.
So, I wrote a simple script to guess random function names over and over until I got a
matching hash.
This took a long time, but I got lucky and found a match.
I deployed a contract with that single function and verified it.
But nothing changed.
I tried calling the function myself, but it just showed the same string of random characters.
At this point, I felt defeated.
Maybe Etherscan uses a centralized database for hashes, or maybe they’re entered by
hand.
I looked everywhere on the Etherscan website to find any information on how unknown functions
are decoded but found nothing.
But 30 minutes later, I saw my function name had been updated.
Additionally, every single swap had been updated with the new name.
I couldn't believe it.
And that's when I had the plan to take over Ethereum.
I searched through blocks and noticed that all of OpenSea’s functions were unverified.
I also targeted 1inch and GemSwap.
But guessing these functions was not going to be easy.
So, I coded a script using Rust to make it 10 times faster.
Now, I could mine a single function in only a few minutes.
I put them all in a single smart contract and verified.
The next morning, I woke up to some pretty interesting comments.
I was gaining a ton of subscribers, but I guess too many people told OpenSea because
I checked again and it was gone.
At first, it was only OpenSea, but Etherscan later removed the rest a few days later.
Now, only the signature shows, although you can still see my custom function through the
input data.
This was sad, but they didn’t fully patch it yet.
Then, I had an even better idea.
See, my functions all ended with XD followed by some random letters to generate the hash.
But I thought of a way to generate one without this.
I started working on a script that uses random inputs instead of function names to guess
hashes.
Wait a sec.
I checked Twitter, and someone asked me if I created this NFT project.
I’ve never heard of it, but he doesn't believe me.
I told him I’ve never done NFTs, but it doesn’t stop him from posting threats.
Now, this really spooked me.
It looks like the project rugged, and because of the function names, they thought I was
responsible.
But I took some deep breaths and explain everything.
In the end, it's all good, and he offered me a free NFT.
I was a bit hesitant before deploying because I felt like I might get some backlash.
At first, I was considering doing something really troll like renaming cancel to burn
NFT, but I didn’t want people to panic, so I made the names obviously fake.
And hey, if I didn't take these functions, someone else could have for more malicious
purposes.
Overall, I have mixed feelings about what I did.
This trick of hashing functions is well known within the developer community, so it wasn’t
too hard for people to figure out what I did based on the random string of letters.
I wish I started out with the new method that doesn’t involve using random letters.
It would have been a lot more interesting.
I also checked the smart contracts I deployed, and to my surprise, someone sent it .5 ETH.
That’s more money than I’ve ever made from YouTube.
The only problem is, that ETH is stuck there forever.
On deployment, I made all my functions payable to save a bit of gas.
However, this had the side effect of allowing users to send ETH along with a transaction.
One user called every single one of my functions with large amounts of money.
These functions were completely empty, so nothing happened.
And because there is no function to recover the ETH, that money is lost forever.
In the end, I still have my custom functions.
You just have to look at the actual transaction to see it.
I also finished my new script and deployed it to prove that it works.
See, no random letters at the end.
So basically, this was all just an advertisement campaign for my YouTube channel.
If you like what you saw, consider subscribing.
It only costs 0.1 ETH.