White Hat iOS Hacker Earns $2 Million Bounty for Finding, Patching 'Critical Bug' in ETH Scaling Platform

As per the developer who fixed the bug, the bug would have allowed any hacker to replicate money and create infinite ETH on any chain.

By Shomik Sen Bhattacharjee | Updated: 11 February 2022 15:39 IST

White Hat iOS Hacker Earns $2 Million Bounty for Finding, Patching 'Critical Bug' in ETH Scaling Platform

Photo Credit: Unsplash/ Moritz Erken

Optimism is a Layer 2 scaling option for the Ethereum network

Highlights

Optimism is an Ethereum Layer 2 scaling project
Optimism was earlier available only to a select number of projects
Optimism claims that the bug had not been exploited

A white hat hacker and iOS Cydia jailbreak software developer has earned a reward of $2 million (roughly Rs. 15 crore) after fixing a "critical bug" in Ethereum Layer 2 scaling project Optimism which could have allowed hackers to create as much Ether in an Optimism account balance as they wanted. Optimism announced that the bug was discovered earlier this month and has been subsequently fixed by an iOS developer who goes by the name Jay Freeman on Twitter, allowing him to earn one of the largest bug-finding awards to date.

In a detailed blog post, Freeman (@saurik) explained on Twitter that the bug would “allow an attacker to copy money on any chain using his OVM 2.0 go-Ethereum fork.” For his efforts, Freeman received one of the largest bug-finding awards to date, with a total award of $2,000,042 (roughly Rs. 15 crore).

Last week, I discovered (and reported) a critical bug (which has been fully patched) in @optimismPBC (a "layer 2 scaling solution" for Ethereum) that would have allowed an attacker to print arbitrary quantity of tokens, for which I won a $2,000,042 bounty. https://t.co/J6KOlU8aSW
— Jay Freeman (saurik) (@saurik) February 10, 2022

According to the Optimism team, “The bug allowed the creation of ETH on Optimism by repeatedly activating the SELFDESTRUCT opcode on a contract that had an ETH balance.”

We're incredibly thankful to saurik for spending so much time analyzing our protocol over the year--enough to find such an important fix! We highly recommend you check out his in-depth breakdown. We'll award the full $2,000,042 promised in our bug bounty. https://t.co/536XK2Bfa5 pic.twitter.com/p8PZujKaDg
— Optimism (@optimismPBC) February 10, 2022

In a separate blog post, the Optimism team noted that its chain history showed that the bug was not exploited, aside from an employee accidentally activating the Ethereum Etherscan data startup, but “no usable surplus was created.”

“The fix was tested and deployed to the Optimism Kovan and Mainnet networks (including all infrastructure providers) within hours of confirmation,” the team said, thanking Infura, QuickNode, and Alchemy for the fast response times.

[Sponsored] Samsung Galaxy S24: The Ultimate Camera Phone With Smarter On-Device AI

“We have also alerted several vulnerable forks of Optimism and bridge providers to the issue. All of these projects have applied the required fix.”

At the end of last year, Optimism removed its whitelist, allowing any developer to start creating projects on the Optimism network. Prior to this, the network was only available to certain projects such as Uniswap and Synthetix. This limitation made it easier for developers to detect and fix potential bugs.

As per its website, Optimism identifies as a Layer-2 scaling protocol for Ethereum applications and is meant to look, feel and behave like Ethereum but cheaper and faster. As for developers building on Optimism, the company tries to make the switch away from the main Ethereum network as seamless as possible without having to go through a long process.

Government Has Sovereign Right to Tax Cryptocurrency: Finance Minister

Are Oppo's new flagship phones any good? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.