Twitter user saves cross-chain bridge from potential exploit

A cross-chain bridge between BitBTC and the Ethereum layer-2 community Optimism has been in a position to keep away from a doubtlessly pricey exploit because of the work of an eagle-eyed Twitter person.

The customized cross-chain bridge provides a ramp for customers to ship belongings between Optimism’s community and BitAnt’s decentralized finance (DeFi) ecosystem, which incorporates yield providers, nonfungible tokens (NFTs), swaps and the BitBTC token, wherein 1 million BitBTC represents 1 Bitcoin (BTC).

Hector Swap: A revolutionary DeFi swap aggregator

2023-04-13

Fantom: Though DeFi-friendly measures show results, FTM remains in limbo

2023-04-11

The BitBTC bridge bug was highlighted by L2 community Abirtrum tech lead Lee Bousfield in an Oct. 18 Twitter submit, warning that “BitBTC’s Optimism bridge is trivially weak.”

Bousfield stated he printed the Tweet because the “workforce has ignored my messages, so I’m going to publish the essential exploit right here.”

BitBTC’s Optimism bridge is trivially weak. Their workforce has ignored my messages, so I’ll publish the essential exploit right here. https://t.co/onyN9SzBjt

— Lee Bousfield (@PlasmaPower0) October 18, 2022

In response to Bousfield, the BitBTC bridge had a bug that will permit an attacker to mint faux tokens on one facet of the bridge, and swap them for actual ones on the opposite.

“The Optimism L2 facet of the bridge helps you to withdraw any token, and it let’s that token choose the L1Token tackle handed to the L1 facet of the bridge. Nonetheless, the L1 bridge utterly ignores what the L2 token was, and simply goes forward and mints the arbitrary L1 token!” he wrote, including that:

“Which means an attacker may deploy their very own token on Optimism, give themselves all the availability, and set that token’s L1 Token to the actual BitBTC L1 tackle.”

For the bug to be exploited efficiently, Bousfield outlined that it might take “7 days to undergo, throughout which the L1 bridge may very well be fastened by way of an improve.”

Shortly after noting such, somebody went on to check that idea, with an attacker trying to withdraw “200 billion faux BitBTC from Optimism.”

The attacker reportedly claimed that it was merea take a look at.

Bousfield additionally famous in a subsequent replace round 10 hours later that the bug had since been patched after he managed to get involved with the BitBTC workforce.

Cointelegraph has reached out to the BitAnt workforce for affirmation on these particulars and can replace the story in the event that they reply.

Associated: Ethereum Alarm Clock exploit results in $260K in stolen fuel charges to this point

Optimism developer Kevin Fichter on Oct. 18 confirmed that the bug was on BitBTC’s facet of issues, because it had used its personal customized bridge versus Optimism’s commonplace bridge it provides to companions.

Fichter additionally famous that belongings “apart from BitBTC are usually not in danger,” including that there was a number of “time and power positioned into the usual bridge” and inspired folks to make use of the usual bridge “except you realize what you’re doing.”

Source link