Ethereum Layer-2 solution Optimism has fixed a critical software bug in one of its smart contracts on Ethereum. On February 2nd, the Optimism team was alerted byJay Freemanof a critical bug in Optimism’s fork of theEthereumGeth client software. As per the Optimismannouncement“Funds Are Safu.”

The bug made it possible for a malicious hacker to create ETH onOptimismby “repeatedly triggering the “SELF-DESTRUCT” opcode on a contract that held an ETH balance.” Opcodes are different types of instructions that can run on the Ethereum Virtual Machine (EVM) execution environment.

Bug triggered by Etherscan employee

Analysis of Optimism’s blockchain history carried out by the Optimism team showed that the bug was not exploited. The bug seems to have been accidentally triggered on one occasion by an employee at the popular block explorer Etherscan.

The reporting came with a criticism from Freeman that blockchain projects shouldn’t treat “basic issues of decentralization or security” as afterthoughts.

‘Unbridled Optimism’ Would Have Seen Anything But

Freeman described in a blog post published yesterday that he discovered the bug to be related to the bridging aspect of the Optimism protocol, the same mechanism that hit the Wormhole protocol earlier this month. Freeman dubbed the bug ‘Unbridled Optimism’ and described in no uncertain terms what it could do:

Exploiting this enables the attacker to have access to an effectively unbounded number of tokens (aka, the IOUs) on the far side of the bridge.

It is my contention that this is more dangerous than merely tricking the reserves into allowing a withdrawl (sic).

As per the report, “no usable excessETHwas generated.”

According to the announcement, within hours of confirmation, the Optimism team developed and deployed a fix on the Kovan and Mainnet networks, mending the bug, and sent alerts to teams developing vulnerable Optimism forks and to L1-L2 bridge providers. Apart from the announcement, the Optimism team has also published a detailedbreakdownof the incident.

As part of Optimism’s Immunefi bug bountyprogram, the maximum amount of just over $2 million was paid out to Jay Freeman.
The fact that the maximum amount was paid, indicates the seriousness of the bug.

L2 eth 2m jay freemanii

Ethereum Layer-2 solution Optimism has fixed a critical software bug in one of its smart contracts on Ethereum. On February 2nd, the Optimism team was alerted byJay Freemanof a critical bug in Optimism’s fork of theEthereumGeth client software.
As per the Optimismannouncement“Funds Are Safu.”

The bug made it possible for a malicious hacker to create ETH onOptimismby “repeatedly triggering the “SELF-DESTRUCT” opcode on a contract that held an ETH balance.” Opcodes are different types of instructions that can run on the Ethereum Virtual Machine (EVM) execution environment.

Bug triggered by Etherscan employee

Analysis of Optimism’s blockchain history carried out by the Optimism team showed that the bug was not exploited. The bug seems to have been accidentally triggered on one occasion by an employee at the popular block explorer Etherscan.

The announcement does not, however, speculate on possible damages if the bug had been exploited by a malicious hacker.

Growing DeFi ecosystem makes security complex

According to Optimism’s blog post, defending the DeFi ecosystem against security issues is becoming increasingly complex, to a significant extent as a direct consequence of decentralization itself.

The post reads:

“it’s clear that the ecosystem will soon be far too large for this to remain practical. We’ll be updating our disclosure protocol to more closely match Geth’s in the near future,”

The post also points to the importance of bug bounty programs.

The Optimism team is currently in the process of specifying and building the next major release, Optimism: Bedrock Edition.

On February 2, the Optimism team was alerted by Jay Freeman (saurik of Cydia and Orchid fame) to the existence of a critical bug in Optimism’s Geth fork. The bug made it possible to create ETH on Optimism by repeatedly triggering the SELFDESTRUCT opcode on a contract that held an ETH balance.” Optimism revealed on its blogsite.

Furthermore, Jay Freeman, best known for creating the Cydia software application and related software, was also awarded over $2 million.

On his blogsite he stated that he reported a critical security issue to Optimism — an “L2 scaling solution” for Ethereum — that would allow an attacker to replicate money on any chain using their “OVM 2.0” fork of go-Ethereum (which they call l2geth).

Reading Time:2minutes

  • A “gray hat” hacker has described how he identified a critical Ethereum bug
  • The bug, in the Optimism L2 code, could have allowed limitless minting of ETH
  • Jay Freeman picked up $2.1 million in bug bounties for the find

A “gray hat” hacker has described how he found a critical flaw in the EthereumOptimism scaling solution that he could have used to mint an unlimited amount of ETH. Jay Freeman (known as ‘Saurik’ online) explained how he found a bug in the Ethereum virtual machine that executes smart contracts on Optimism, but instead of using it to mint a barrel load of ETH he reported it and took home $2.1 million in total bounties.

The announcement does not, however, speculate on possible damages if the bug had been exploited by a malicious hacker.

Growing DeFi ecosystem makes security complex

According to Optimism’s blog post, defending the DeFi ecosystem against security issues is becoming increasingly complex, to a significant extent as a direct consequence of decentralization itself.

The post reads:

“it’s clear that the ecosystem will soon be far too large for this to remain practical. We’ll be updating our disclosure protocol to more closely match Geth’s in the near future,”

The post also points to the importance of bug bounty programs.

The Optimism team is currently in the process of specifying and building the next major release, Optimism: Bedrock Edition.

نقص فنی مهم راهکار لایه-2 اتریوم موسوم به

Optimism در کلاینت نرم‌افزاری Geth شناسایی و رفع شد. Jay Freeman فردی بود که این باگ را در روز دوم فوریه به‌اطلاع تیم توسعه‌‌دهندگان اتریوم رساند، در اعلامیه‌ی منتشر شده از سوی راهکار Optimism آمده است که «دارایی‌های کاربران امن بوده و آسیبی به‌آنها وارد نشده است.»

این نقص فنی به هکرهای مجرم اجازه می‌داد تا با اجرای مکرر آپ‌کد (کد دستوری) «خود-تخریب/SELF DESTRUCT» بر یک حساب دارای موجودی اتریوم، اقدام به ایجاد توکن‌های ETH نمایند.

آپ‌کدها مجموعه‌‌های متنوعی از دستوراتی هستند که می‌توانند در محیط ماشین مجازی اتریوم (EVM) اجرا شوند.

کارمند Etherscan این نقص را ایجاد کرد

براساس مطالعه‌ی تیم توسعه‌دهنده‌ی Optimism، این باگ فنی مورد سوءاستفاده قرار نگرفته بلکه توسط یکی از کارمندان سایت معروف Etherscan سهوا ایجاد شده است.

As per the report, “no usable excessETHwas generated.”

According to the announcement, within hours of confirmation, the Optimism team developed and deployed a fix on the Kovan and Mainnet networks, mending the bug, and sent alerts to teams developing vulnerable Optimism forks and to L1-L2 bridge providers. Apart from the announcement, the Optimism team has also published a detailedbreakdownof the incident.

As part of Optimism’s Immunefi bug bountyprogram, the maximum amount of just over $2 million was paid out to Jay Freeman.
The fact that the maximum amount was paid, indicates the seriousness of the bug.

Similar Posts:

Leave a comment