{"type": "project", "title": "ENS Spoofing Bot", "logoImg": "bafkreig2qp4nfb7tf2pjugznszykzpbk4eacrquglpxvooncwc252tungm", "website": "https://github.com/kovart/forta-ens-spoofing", "bannerImg": "bafybeibicei4a233miqwcqxezfgh463pm4hrs4mmqxq4efcx2z6uydshem", "createdAt": 1673822109044, "userGithub": "kovart", "credentials": {"twitter": {"type": ["VerifiableCredential"], "proof": {"jws": "eyJhbGciOiJFZERTQSIsImNyaXQiOlsiYjY0Il0sImI2NCI6ZmFsc2V9..CTRGHoXifusm-HZS_FP18gelC1wtguU1JwxrP2AFL3VkVIrmWVvAGdi0XJ5ln0ZPpGvmkLVKLELq19KNxbgpDA", "type": "Ed25519Signature2018", "created": "2023-01-15T21:55:08.055Z", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC#z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC"}, "issuer": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC", "@context": ["https://www.w3.org/2018/credentials/v1"], "issuanceDate": "2023-01-15T21:55:08.055Z", "expirationDate": "2023-04-15T21:55:08.055Z", "credentialSubject": {"id": "did:pkh:eip155:1:0x7b736FE138775D1fCD2CFE4E1D6158BfF3a2F28e", "hash": "v0.0.0:It9lxqJk6UVkZ40xHR1g6QuLkkg+24NZle9CVuvu3/k=", "@context": [{"hash": "https://schema.org/Text", "provider": "https://schema.org/Text"}], "provider": "ClearTextTwitter#kovart_dev"}}}, "description": "ENS Spoofing Bot detects attacks in which someone registers a name visually similar to an existing one. Every ENS user can receive a notification if it happened to their name. \n\n\nThe problem\n\nNames in the Ethereum Name Service are unique, but there are no restrictions on registering look-alike names that are visually very difficult to distinguish from genuine ones. For example, having a name vitalik.eth, an attacker can register a similar name by replacing the symbol lowercase L with uppercase i: vitaIik.eth. The name is visually similar, but it is treated by the protocol as a completely different name, with its own hash, as well as an address bound to it. \n\nThis type of attack is called a homograph attack. Regarding the ENS protocol, it can be performed in the following ways:\n- Substitution of character pairs i/I, i/j, O/0, w/vv, m/rn, etc., which depending on the typeface, may be difficult or impossible to distinguish;\n- Replacing ASCII characters with visually similar ones from Unicode; for example, \u201cfa\u0441eboo\u0441k.eth\u201d uses the letters o and \u0441 from Cyrillic;\n- Use of invisible Unicode symbols; \n- Spoofing using uppercase letters; for example, bitcoin.eth may be spoofed as Bitcoin.eth. \n\nENS fights this attack pretty hard by normalizing names before they are registered, as well as warning against using non-ascii characters on its site. However, to save gas, such checks have been implemented off-chain, on the frontend side. Any user can register a name bypassing the official site by calling the protocol contract directly.\n\n\nThe solution\n\nDevelop a Forta bot that monitors on-chain contract events responsible for registering \".eth\" names. As soon as the bot detects a new registered name, it tries to normalize it and checks if a similar name has already been registered. If so, the bot fires an alert specifying the registered name, the existing normalized name, and the addresses of the accounts to which these names are bound.\n\nForta Protocol allows each user to subscribe to alerts involving their addresses, so if their name is spoofed, they will immediately receive a notification in one of the convenient ways: Email, Telegram, Discord, Slack or Webhook.\n\nIn addition, when combined with bots that detect subsequent stages of suspicious activity, we will have enough evidence to claim a scam attack. For example, the next follow-up checks could be obtaining tokens, selling them, and laundering funds through services like Tornado Cash. \n\nAs a result, the Forta ENS Spoofing Bot will play an important role in detecting scam attacks, maximizing the chances of their detection.\n\n\nAbout the Author\n\nI'm a Ukrainian developer, who has been developing bots for Forta Protocol since the beginning of the project. You may have seen me as a frequent contest winner as well as an active member of the community. At the moment I developed 19 bots, some of them are in the Forta Threat Detection Kit.", "logoImgData": {}, "bannerImgData": {}, "projectTwitter": "kovart_dev"}
ENS Spoofing Bot
ENS Spoofing Bot detects attacks in which someone registers a name visually similar to an existing one. Every ENS user can receive a notification if it happened to their name. 


The problem

Names in the Ethereum Name Service are unique, but there are no restrictions on registering look-alike names that are visually very difficult to distinguish from genuine ones. For example, having a name vitalik.eth, an attacker can register a similar name by replacing the symbol lowercase L with uppercase i: vitaIik.eth. The name is visually similar, but it is treated by the protocol as a completely different name, with its own hash, as well as an address bound to it. 

This type of attack is called a homograph attack. Regarding the ENS protocol, it can be performed in the following ways:
- Substitution of character pairs i/I, i/j, O/0, w/vv, m/rn, etc., which depending on the typeface, may be difficult or impossible to distinguish;
- Replacing ASCII characters with visually similar ones from Unicode; for example, “faсebooсk.eth” uses the letters o and с from Cyrillic;
- Use of invisible Unicode symbols; 
- Spoofing using uppercase letters; for example, bitcoin.eth may be spoofed as Bitcoin.eth. 

ENS fights this attack pretty hard by normalizing names before they are registered, as well as warning against using non-ascii characters on its site. However, to save gas, such checks have been implemented off-chain, on the frontend side. Any user can register a name bypassing the official site by calling the protocol contract directly.


The solution

Develop a Forta bot that monitors on-chain contract events responsible for registering ".eth" names. As soon as the bot detects a new registered name, it tries to normalize it and checks if a similar name has already been registered. If so, the bot fires an alert specifying the registered name, the existing normalized name, and the addresses of the accounts to which these names are bound.

Forta Protocol allows each user to subscribe to alerts involving their addresses, so if their name is spoofed, they will immediately receive a notification in one of the convenient ways: Email, Telegram, Discord, Slack or Webhook.

In addition, when combined with bots that detect subsequent stages of suspicious activity, we will have enough evidence to claim a scam attack. For example, the next follow-up checks could be obtaining tokens, selling them, and laundering funds through services like Tornado Cash. 

As a result, the Forta ENS Spoofing Bot will play an important role in detecting scam attacks, maximizing the chances of their detection.


About the Author

I'm a Ukrainian developer, who has been developing bots for Forta Protocol since the beginning of the project. You may have seen me as a frequent contest winner as well as an active member of the community. At the moment I developed 19 bots, some of them are in the Forta Threat Detection Kit.
ENS Spoofing Bot