Critical bug in Ethereum L2 Optimism, $2M bounty paid

Ethereum Layer-2 resolution Optimism has fastened a essential software program bug in one among its good contracts on Ethereum. On February 2nd, the Optimism staff was alerted by Jay Freeman of a essential bug in Optimism’s fork of the Ethereum Geth consumer software program. As per the Optimism announcement “Funds Are Safu.”

The bug made it potential for a malicious hacker to create ETH on Optimism by “repeatedly triggering the “SELF-DESTRUCT” opcode on a contract that held an ETH stability.” Opcodes are several types of directions that may run on the Ethereum Digital Machine (EVM) execution setting. 

Bug triggered by Etherscan worker

Evaluation of Optimism’s blockchain historical past carried out by the Optimism staff confirmed that the bug was not exploited. The bug appears to have been by chance triggered on one event by an worker on the fashionable block explorer Etherscan. As per the report, “no usable extra ETH was generated.”

In line with the announcement, inside hours of affirmation, the Optimism staff developed and deployed a repair on the Kovan and Mainnet networks, mending the bug, and despatched alerts to groups growing weak Optimism forks and to L1-L2 bridge suppliers. Aside from the announcement, the Optimism staff has additionally revealed an in depth breakdown of the incident.

As a part of Optimism’s Immunefi bug bounty program, the utmost quantity of simply over $2 million was paid out to Jay Freeman. The truth that the utmost quantity was paid, signifies the seriousness of the bug. The announcement doesn’t, nevertheless, speculate on potential damages if the bug had been exploited by a malicious hacker.

Rising DeFi ecosystem makes safety advanced

In line with Optimism’s weblog submit, defending the DeFi ecosystem towards safety points is turning into more and more advanced, to a big extent as a direct consequence of decentralization itself.

The submit reads:

“it’s clear that the ecosystem will quickly be far too giant for this to stay sensible. We’ll be updating our disclosure protocol to extra carefully match Geth’s within the close to future,”

The submit additionally factors to the significance of bug bounty packages. 

The Optimism staff is presently within the means of specifying and constructing the following main launch, Optimism: Bedrock Version. In line with Optimism, Bedrock Version will considerably scale back the distinction within the code base between Optimism’s Geth fork, and the “official” go-ethereum consumer. Not having to switch as a lot of the unique code makes it much less prone to introduce bugs.