Bitcoin News and Finance
Cydia Dev Discloses Ethereum L2 Bug — Optimism Attacker Could Have ‘Printed an Arbitrary Quantity of Tokens’ Skip to main content

Cydia Dev Discloses Ethereum L2 Bug — Optimism Attacker Could Have ‘Printed an Arbitrary Quantity of Tokens’

Cydia Dev Discloses Ethereum L2 Bug — Optimism Attacker Could Have 'Printed an Arbitrary Quantity of Tokens'

On February 10, the well-known developer of Cydia and iOS Jailbreak, Jay Freeman, otherwise known as Saurik, published a Twitter thread about a bug he found in the Layer-2 (L2) scaling protocol known as Optimism. According to Freeman, the vulnerability, which has been patched, could have allowed an attacker to create an infinite amount of tokens.

Cydia Creator ‘Saurik’ Discovers Optimism L2 Vulnerability

Jay Freeman is a prominent software developer who is well known for his iOS Jailbreak and Cydia tools. Freeman’s Cydia graphical user interface (GUI) was released in February 2008, and it gives users with jailbroken iPhones the ability to download unauthorized software for the Apple smartphone operating system iOS. Freeman recently published a blog post called “Attacking an Ethereum L2 with Unbridled Optimism,” which explains how he reported a critical security issue to the developers of the L2 scaling solution Optimism.

Optimism’s L2 solution allows users to move ethereum for a fraction of the cost. Currently, moving ether using Optimism can cost $0.56 per transfer as opposed to the L1 gas fees today which are $3.29 per transaction. To swap coins onchain using L1 it will cost a user $16.47 in ether but using Optimism to swap coins will cost $0.83. Freeman reported the Optimism vulnerability on February 2, 2022 and the bug has since been patched.

The attack would have allowed “an attacker to replicate money on any chain using their “OVM 2.0” fork of go-ethereum (which they call l2geth),” Freeman said. The developer further explained that he plans to talk about the Optimism vulnerability on February 18th at Ethdenver 2022. Freeman was also awarded a $2,000,042 bounty for discovering the bug and disclosing it to the team. The software engineer’s blog post describes how the attacker could mint an arbitrary quantity of tokens before the bug was patched.

“The bug presented here — which I dub ‘Unbridled Optimism’ — can maybe be (crudely) modelled as a bug on the far side of a ‘bridge,’” Freeman wrote. “But is actually a bug in the virtual machine that executes smart contracts on Optimism. Exploiting this enables the attacker to have access to an effectively unbounded number of tokens (aka, the IOUs) on the far side of the bridge. It is my contention that this is more dangerous than merely tricking the reserves into allowing a withdrawal.” The developer continued:

Further, with your unbounded supply of IOUs, you could go to every decentralized exchange running on the L2 and mess with their economies, buying up vast quantities of other tokens while devaluing the chain’s own currency. Using your access to infinite capital, you could further manipulate onchain pricing oracles to leverage for other attacks; and, until someone finally realizes your money is counterfeit, arbitragers will flock to the network to sell you their assets.

The Pessimism Surrounding Cross-Chain Applications

In addition to the vulnerability found in Optimism, Freeman discussed cross-chain bridge technology in great detail. The developer mentioned that the same day he disclosed the bug to Optimism, the Wormhole bridge was attacked. Freeman also touched upon the Poly Network hack in his post. “Even when hackers do steal money from a bridge, the ramifications are limited,” Freeman’s blog post explains.

Freeman discovering the Optimism bug follows the slew of hacks against cross-chain bridges and the community’s newfound concern over the security of this up-and-coming technology. The Cydia developer’s blog post mentions concepts like “’insurance policies’ against crypto hacks.” Moreover, Ethereum (ETH) co-founder Vitalik Buterin recently discussed concerns tied to the security of cross-chain bridge platforms. “I am pessimistic about cross-chain applications,” a recent Reddit post by Buterin declares.

What do you think about Jay Freeman’s Optimism bug discovery? Let us know what you think about this subject in the comments section below.

Labels:

Comments

Post a Comment

Popular posts from this blog

Custodial Lightning Network Service Attack Discovered by LN ‘Newbie’ — Hacker Strikes 6 LN Custodians

On September 18, a Redditor posted to the r/bitcoin forum and explained how he discovered a way to “attack [the] lightning Network’s custodial services.” The Reddit account dubbed “Reckless Satoshi” wanted to figure out if a “discrepancy between real routing fees and service’s transaction fee can be exploited for a profit.” The researcher disclosed that he wanted to see how large the damage could be and said “it is bad.” 6 Lightning Network Custodial Services Attacked, Researcher Discloses Findings to Offenders Prior to Public Disclosure A Redditor called Reckless Satoshi published a disclosure post on r/bitcoin this past Saturday and disclosed how he had found a vulnerability with routing fees and some of the Lightning Network’s custodial services. The research attack was done in good faith and after it was complete he disclosed the bugs to the offending services before publishing his findings. Reckless Satoshi used the Lightning Network (LN) attack on six different services incl
Post a Comment
Read more

Axie Infinity Down 40% Since Last Week’s Price High, Protocol Revenue Outshines Competitors

Last week, the game token leveraged within the Axie Infinity gaming universe skyrocketed to all-time highs, while other crypto markets remained extremely lackluster. During the last seven days, Axie Infinity’s platform token has dropped significantly in value shedding more than 12%. Meanwhile, the game platform’s smooth love potion token has slid over 8% over the last 24 hours. Axie Infinity Down More Than 40% Since All-Time High Not too long ago, the axie infinity (AXS) token was a topical conversation because it reached an all-time high on July 15. At the time, AXS managed to capture $28.93 per unit and since then it has shed 12.8% during the last seven days. The axie infinity (AXS) token is used within the blockchain-based game that involves battles between token-based creatures called “Axies.” AXS is used for the game’s governance system as well as other actions within the game. At the time of writing axie infinity (AXS) is exchanging hands for $16.70 per coin. AXS/USD on Ju
Post a Comment
Read more

Play-to-Earn Game From Polker (PKR) Exchange Listing – Endorsed by Akon

The Play-to-Earn NFT based Polker.Game ‘s native token $PKR has been officially listed on the popular centralized exchange BitMart. Polker.game has been in the spotlight recently as Akon, the American R&B superstar and record producer gave his official endorsement of polker stating that the “game is revolutionary” and that Polker is “hands down.. the best play to earn, NFT game in the space.”. With the BitMart listing and celebrity endorsement from Akon, Polker is perfectly positioned to become a major player in the Play-to-Earn league. Watch Akon’s Video Here What is Play-to-Earn? Although not a new concept, play-to-earn has become a trending term due to the popularity of the NFT game AXIE infinity. In the past, previous play-to-earn games have also achieved success – however, thanks to the huge amount of development in the blockchain space in recent years the gaming experience is now massively improved. Play-to-Earn games are essentially free to play and open to anyone and
Post a Comment
Read more

China to Crack Down on Copyright Infringement Through NFTs

Authorities in China are going after creators of digital collectibles based on other people’s works of art, the use of which was not authorized. The government offensive is part of a campaign to combat online copyright infringement and piracy with the participation of several departments. Regulators in China Move to Strengthen Copyright Supervision of Online Platforms The National Copyright Administration of China (NCAC) has recently launched a campaign against copyright infringement and piracy on the internet, together with the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Internet Information Office of the People’s Republic. A major objective of the initiative is to improve copyright supervision of online businesses by investigating cases involving the sale and distribution of infringing products on short video, live broadcast and e-commerce platforms, and promptly dealing with infringing content, the agency announced in a press r
Post a Comment
Read more
Blogarama - Blog Directory