A critical flaw has been discovered by a famous hacker. It allowed to create an infinite amount of ETH tokens.
The Optimism platform was close to sinking into pessimism, following the discovery of a critical flaw. Creating money with the click of a button – modern version of printing money – is a dream for many and a famous hacker has figured out how to do it. Jay Freeman could have folded Optimism, Ethereum’s second layer solution, after finding a gaping flaw. It allowed to generate infinite ETH tokens, as explained by Jay Freeman and Optimism. On Twitter, Jay Freeman tells how he discovered and reported a breach that could have jeopardized the future of the Optimism network.
Last week, I discovered (and reported) a critical bug (which has been fully patched) in @optimismPBC (a “layer 2 scaling solution” for Ethereum) that would have allowed an attacker to print arbitrary quantity of tokens, for which I won a $2,000,042 bounty. https://t.co/J6KOlU8aSW
— Jay Freeman (saurik) (@saurik) February 10, 2022
A $2 million reward
If his name means nothing to you, Jay Freeman is also the developer behind Cydia. This unofficial store for iOS is an alternative to the App Store on the iPhone; it is particularly popular with jailbreak enthusiasts. Faced with the seriousness of the fault, the one who calls himself Saurik obtained a reward of 2,000,042 dollars. A tidy sum which, however, prevents Optimism from experiencing darker times. The platform also thanked the developer and returned to the incident in a blog post.
We’re incredibly thankful to saurik for spending so much time analyzing our protocol over the year–enough to find such an important fix! We highly recommend you check out his in-depth breakdown. We’ll award the full $2,000,042 promised in our bug bounty. https://t.co/536XK2Bfa5 pic.twitter.com/p8PZujKaDg
— Optimism (@optimismPBC) February 10, 2022
It confirms having been alerted on February 2 of the existence of a critical bug; allowing to create an infinite number of ETH. After verification, she adds that the flaw was not exploited and that it could be corrected. “We have also alerted several forks [dérivés d’Optimism] and bridge suppliers [bridge] Optimism vulnerable to the presence of the problem. These projects have all applied the required correction”, adds the platform. In return, it therefore granted the maximum bounty of its Bounty bug program to Jay Freeman. “We are extremely grateful to hackers like saurik who help keep Optimism secure”she adds.
“Every line of code counts”, recalls Optimism
The platform concludes by explaining that this event is an opportunity to reflect on itself and to see the point on the avenues for improvement. Optimism explains that the “decentralization breeds complexity” ; and that this bug comes from “change to go-ethereum codebase”. Finally, this case is a further reminder of the importance of bug bounty reward programs. For Optimism, they are a ” need “.
