Arbitrum Saved From Major ETH Loss by White Hat Hacker

An anonymous developer effectively saved Arbitrum from a $250 million loss

article-image

Blockworks Exclusive art by axel rangel

share

key takeaways

  • Arbitrum paid 400 ETH via ImmuneFi to white hat hacker
  • Arbitrum bridge bug was caused by bad initializers in the contract code

Another cryptocurrency vulnerability has been uncovered by a so-called white hat hacker, who found an exploitable bug in the bridge between Ethereum and Arbitrum Nitro.

The hacker, known as riptide on Twitter, outlined their discovery, which comes on the heels of an escalating series of hacks in the bridges that connect different blockchains, which collectively have been drained of hundreds of millions of dollars of predominantly user funds this year. 

Arbitrum, the layer-2 Ethereum scaling solution, paid riptide a bounty of 400 ether (ETH) as a reward via the bug bounty platform ImmuneFi.

The multi-million dollar vulnerability, as riptide called it, would have allowed an attacker to steal all incoming ether deposits from users attempting to bridge their assets between Ethereum layer-1 and layer-2 protocols to Arbitrum.

The initialization-related vulnerability, according to the white hat hacker, would have enabled any nefarious actor to impersonate a user and send the authentication message to the “sequencerInbox” function to execute the vulnerability. 

The largest deposit recorded on the inbox contract was 168,000 ETH, around $250 million, with average deposits ranging from 1,000 to 5,000 ETH in a 24-hour period, riptide said. 

Loading Tweet..

Another Twitter user, smartcontracts.eth, commented that “rollups are still heavily in development,” cautioning his followers to be careful on layer-2 protocols. A layer-2 refers to a mechanism built on top of a blockchain’s core layer, typically to increase scalability or speed, plus introduce additional features. 

A similar bug was seen in the token bridge Nomad’s smart contract, which cost the protocol  $190 million in cryptocurrency in the third-biggest cryptocurrency hack of the year.

Arbitrum recently launched Nitro exactly one year after the rollup’s now-defunct first iteration and ahead of the Merge.

Arbitrum NFTs

Additionally, Arbitrum plans to integrate with NFT marketplace OpenSea on Wednesday. 

A slew of NFT collections built on Arbitrum will be available to buy and sell directly on OpenSea.

OpenSea tweeted that creators would need to find their collections and set their creator fees directly. 

The marketplace recently added the royalties percentages front-and-center on a collection’s page.

Loading Tweet..

Don’t miss the next big story – join our free daily newsletter.

Tags

Upcoming Events

HYATT REGENCY SALT LAKE CITY

TUES, OCT. 8, 2024

Guided by the expertise of Blockworks Research Analysts team, this one day event will feature senior leaders, entrepreneurs, and developers from across the crypto industry. Attendees will have the opportunity to participate in an immersive experience to explore the latest trends, […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

hivemapper.jpeg

Research

We believe crypto market participants overlook Hivemapper’s fundamental potential due to a poor understanding of both the niche map data market and Hivemapper’s positioning relative to incumbents. Hivemapper’s token model catalyzes both a cost and product advantage via unmatched map freshness and near real-time accuracy, which is its wedge into a market characterized by stale data and high data collection costs. Its current and potential future product suite may represent one of the strongest possibilities for PMF in crypto today.

article-image

The Department of Justice and Commodity Futures Trading Commission announced back-to-back lawsuits against KuCoin Tuesday

article-image

Judge Failla found that Coinbase didn’t operate as an unregistered broker in offering its wallet service

article-image

A fund by Laser Digital offers investors exposure to the Polygon network, while a new 21Shares ETP focuses on staking rewards from Toncoin

article-image

Sponsored

The TRON network’s integration into Dune brings a wealth of data and insights to the fingertips of users

article-image

A BTC futures fund offered by Hashdex and Tidal Investments has gotten regulatory clearance to hold bitcoin directly

article-image

At launch, Chain Signatures will be compatible with Bitcoin, Ethereum and Cosmos network chains, as well as DogeCoin and XRP Ledger