After hardening the security of it, I have brought back the mainnet and testnet faucets @ spigot.grinminer.net for mainnet and with the same limit of 1ツ every 24 hours. Testnet you can claim 1000ツ every 4 hours. On both you must solve a CAPTCHA first to use them.
Please test and give feedback, thanks to some very generous donations the mainnet faucet has plenty of funds I will trickle in as needed.
You might wanna update the page, get rid of form fields which permitted the attack, and change that address down the bottom unless you have already.
Sorry to hear this. Rather surprising the attacker didn’t help themselves to the funds. Are they a white hat? If so why not just DM you? I guess we’ll never know.
Out of curiosity how many grin did they decide not to steal, and how do you suppose they extracted your seedphrase (can you see their injected commands)?
I’ve cut off access to the frontend and shut down the backend, and that method of attack is now mitigated against. I’ll be creating a new wallet and do some additional pentesting on it before I put it back up Monday.
Fricking haxxorz!! At least ya didn’t lose any funds! Keep up the good work transatoshi. Gotta give it to the grin community, they sure know their way around a keyboard!
I have touched up the code and it’s ready to deploy, unfortunately I have to re-sync the node as it wouldn’t start after a reboot due to not finding the “header_hash”.
I will let you all know once it is synced and the faucet is started. And in case the faucet were to be hacked again, I’m only keeping a few bucks of ツ in the faucet at a time, so if the worst happens most funds will still be safu.
Hi! This doesn’t seem to work. (Maybe just me) Wallet Checker shows my address is online. Captcha is SUCCESS. But in the end I get the message - Error: Failed to fetch. And when I copy response I don’t get Slatepack, but the same error - Error: Failed to fetch.