Airdrop List:

0xb68F52FE2583b5a568E7E57dc98c69d93821f6e4: 210 Matic

https://polygonscan.com/tx/0xc124a31c2c4ef2720c1135f3cfdddab64fde5d0d477124f4693dee7ab4861493

0x2B45771fa21Df7ACDDaF450589F57112F99Cb44A: 130 Matic

https://polygonscan.com/tx/0xa67aea08cea5a89bff27354c7ddad2e85b7f7ca357658175be96efcce3df9cb6

0xb1C7A48047DeBd87E5DEEce9FCb1257aAF420f10: 80 Matic

https://polygonscan.com/tx/0x4d17ec969da11a6914b06e4fa383f0f27de76ac2525872da1639f6c6a1cb338c

0xEE12C640b0793cF514E42EA1c428bd5399545d4D: 20 Matic

https://polygonscan.com/tx/0xda38a1c46fbed88c892f940a6ae65c086b2156c7705872c7f94620943a82d558

0x045ff23cF3413f6A355F0ACc6eC6cB2721B95D99: 10 Matic

https://polygonscan.com/tx/0x172e7638f9d8c8b6768b2bc41723c0f5b3ca1ac45bbec43e2bcbd479ec0c13d0

0x40d0308215956928Dc67CFaa76202D0F9694e003: 10 Matic

https://polygonscan.com/tx/0x61b5ce570f123020ee8aa66d7a537001eff0ce1d1f1342cf751a298045e88570

0x51AE47d66E1434574632403a2EdE8E2d7CEE70b9: 10 Matic

https://polygonscan.com/tx/0x3205d0f0359c18eea66201cf8c80050e6b38a3476c4be298d94969ca78004ab5

0xA689990f67e9F09D3a6E9836e16ae925239b8BfC: 10 Matic

https://polygonscan.com/tx/0xb8bcc66ce5f7903d150362b244a899694f6d494e3c59a256e5b1a2cde9ea0d3c

0x19Bf4fE746c370E2930cD8C1b3DcFA55270c8eD7: 10 Matic

https://polygonscan.com/tx/0xc148e437c263a7b8cd0be39fd9c0cc5465a40076818d6cf29e00abca6066b3f9

0xEa343ff3C072542733f9A2c749EA06aEcA3317e9: 10 Matic

https://polygonscan.com/tx/0x19add6435b1c159c64ddba9e47c1b92240431e3449fbea1aeb264ff762f8218d

The hack:

https://polygonscan.com/tx/0x8539ba8f0d5a55273108432578f77b92a66a22dbeb80032940d33c08926e86bd

To test the dark forest of Ethereum, and also to encourage hackers to report their hacked addresses. We airdrop one of the 0xDeadList addresses in Polygon:

https://polygonscan.com/address/0x40d0308215956928dc67cfaa76202d0f9694e003

We choose this address for the following reasons:

1. It has not been buried in the Polygon mainnet before the hack happened.

2. The 0xDeadList Dev team used this account to test the 0xDeadList contract, and the account has been buried during the test. For example, the account has been sent a tombstone SBT (with its private key in the ERC-721 Token ID), see this transaction for more details:

   https://rinkeby.etherscan.io/tx/0x6473db20f9b341745becde9811c331befff1a95bae7427f66929b815b209128e

We think that it’s harder for hackers to find this leaked address, but let’s see what happened before the hack:

1. The address has been leaked 100 days ago (buried in Rinkeby), and first has a balance in Polygon 90 days ago (5 Matic). Although we have no idea when hackers found this leaked address, the hack never happened until yesterday.

2. We transfer 0.616 ETH to this address (transaction 1) and nothing happened.

3. We swap the 0.616 ETH into 966.905 Matic (transaction 2) in block height 34675224, and after 3 blocks (block height 34675227), a hacker has stolen all 970 Matic (transaction 3).

Is it interesting? Welcome to find more details about this hack and discuss it with us in our Discord.

https://discord.gg/WMZdx5hbr2

DApps应该及时知道私钥被泄露或者公开的账户，并对这些账户的拥有者提供保护，例如：web3邮件需要暂停用户对这些账户邮件的访问；地址在私钥泄露后签署的协议将不能视为该地址真实拥有者授权的。

为了解决上述问题，我们提出了0xDeadList项目用于维护一份私钥已经泄露的地址名单。0xDeadList通过奖励NFT，激励用户和黑客报告私钥丢失的账户，并将这些泄露账户的信息存储在链上，方便DApps查询这些不安全的账户：用户主动挂失的账户和私钥泄露的账户。

0xDeadList 项目简介

0xDeadList鼓励用户收集已经泄露了私钥的地址，用户可以直接登陆 0xdeadlist.io 上报泄露的账号。为了防止front-running攻击，并让所有者在泄露的私钥完全公开之前有一些处理时间，0xDeadList合约提供了简单的两个步骤：锁定地址和埋葬地址。在第一步中，用户锁定将要埋葬的地址，合约会记录锁定者的地址，此时，被锁定地址的私钥不会被公开。在第二步中，用户上传埋葬地址的私钥，合约里记录的锁定者地址会获得一个NFT奖励，表示其埋葬了该地址，同时被埋葬地址会获得一个SBT作为墓碑，表示该地址私钥已经泄露。这一步中，被埋葬地址的私钥会被公开（记录在链上）。

目前该项目已经得到 MetaMail 和 EthSign 的支持，后续我们会根据用户收集地址的价值对埋葬私钥泄露地址的用户提供奖励。

如何埋葬地址：

登陆 0xdeadlist.io，连接钱包，根据指引埋葬地址即可。埋葬成功后，用户可以在OpenSea上查看奖励的NFT和被埋葬地址的SBT。

埋葬者NFT：OpenSea。

墓碑SBT：OpenSea。

如何获取0xDeadList的地址名单：

通过链上/链下接口获得被锁定和被公开的地址，具体请见：Github。

关于我们：

网站 | Twitter | Discord | Github

DApps should be aware of leaked or disclosed accounts in a timely manner, and provide protection to the owners of these accounts. For example, web3 mail needs to suspend users' access to these accounts' emails; agreements signed after the private key is leaked will not be regarded as authorized by the real owner of the address.

In order to solve the above problems, we propose the 0xDeadList project to maintain a list of addresses whose private keys have been leaked. By rewarding NFTs, 0xDeadList encourages users and hackers to report accounts with lost private keys, and stores the information of these leaked accounts on the chain to facilitate DApps project parties to query these insecure accounts.

0xDeadList Project Introduction

0xDeadList encourages users to collect addresses that have leaked private keys. Users can directly log in to 0xdeadlist.io to report the leaked account. To prevent front-running attacks and let the owner has some processing time before the private key is fully disclosed, the 0xDeadList contract provides a simple two steps: lock address and bury address. In the first step, the user locks the address to be buried, and the contract records the address of the locker. At this time, the private key of the locked address will not be disclosed. In the second step, the user uploads the private key of the burial address, and the locker address recorded in the contract will receive an NFT reward, indicating that the address is buried, and the buried address will receive an SBT as a tombstone, indicating that the address’s private key has been leaked. In this step, the private key of the buried address will be made public (recorded on-chain).

At present, the project is supported by MetaMail and EthSign. In the future, we will provide rewards to users who bury private key leaked addresses according to the value of these addresses.

How to Bury Address:

Log in to 0xdeadlist.io, connect the wallet, and bury the address according to the instructions. After the burial is successful, users can view the rewarded NFT and the SBT of the buried address on OpenSea.

Burier NFT: OpenSea.

Tombstone SBT: OpenSea.

How to get the address list of 0xDeadList:

Locked and disclosed addresses can be obtained through on-chain/off-chain APIs. For details, please refer to Github.

About us:

Website | Twitter | Discord | Github