Trying to Transfer ownership from compromised wallet

Manifold Support Questions
1

I have a wallet that has been compromised which was used to deploy two contracts with Manifold.

In etherscan I have done contract > write as proxy > transfer ownership and entered the new wallet to transfer to. But back on the contracts page it’s still showing the old wallet as the owner and when I go to Read Contract it’s showing: 1. implentation: Returns the current implementation address: and then a random address I’ve not seen before. Link below:

Link to ‘read contract’

I’m not sure what else we’re supposed to do to transfer the ownership as the instructions on the Manifold article only say to use write proxy.

Manifold how to transfer ownership

I have removed access to the Manifold studio account from the original wallet.

I can’t find anywhere for security specific questions so please advise on what steps to take next.

2

Sorry to hear that. Could you share a link to the transaction (etherscan) where you executed the transfer ownership action?

3

These two addresses shows where I’ve then gone through to ‘write as proxy’ and then tried to transfer ownership. The Write contract part says it’s not possible to write functions publicly.

https://etherscan.io/address/0xa3fb206038833ae0627e73df7bedf146e40b0e46#writeProxyContract

https://etherscan.io/address/0xe865a1972e247ad6efb9c10d9e51d775eb963abe#writeProxyContract

And the ‘Read Contract’ is where I get the 'Returns the current implementation address.

0xE9FF7CA11280553Af56d04Ecb8Be6B8c4468DCB2 address’

Trying to access the Read Contract to confirm they’ve been updated and secured.

4

Could you confirm the address of your new wallet?

To confirm the ownership update, go to “Read Contract as Proxy” and click on “14. owner”

For example, on your LC contract, the owner is updated to 0x248876a8e9273eD0680baF93E0046BB06B0B5F56

5

Yes this is the wallet address that should now have ownership.
The compromised account was 0x61D910d6332F23B39D4C727Eaf8F1dd288406e94 (the previous owner).

Is it normal to not be able to read the contract normally and not through proxy?

If the ownership has been transferred I think we should now be secure

6

Feels strange that reading the contract takes you to a seemingly random contract address: https://etherscan.io/address/0xE9FF7CA11280553Af56d04Ecb8Be6B8c4468DCB2

7

You should check the same is true for your owner contract LOBCAM.

The latest Manifold contracts contain code linked to a common library (hence proxy) to save you gas on deployment. They’re all open source in the case you’re curious: GitHub - manifoldxyz/creator-core-solidity

8

Yes both now read as the updated contract so I believe both should now be secure unless anything seems abnormal to you.

Thanks for your help and for sending the info interesting to know!

1 Like