Macauley Peterson

Munchables, a GameFi project built on Blast, reported late Tuesday that it was “compromised” to the tune of $62 million.



A further $25 million was spared in a related vault of Juice Finance due to an apparent typo.



By blacklisting the hacker’s address, the network was able to seal off the funds, and convince the attacker to give up the controlling private keys.



And that’s not all that’s unusual.



On-chain evidence provided by investigator ZachXBT indicates that the culprit went by a variety of pseudonyms.



“Four different devs hired by the Munchables team and linked to the exploiter are likely all the same person,” he <a href="https://x.com/zachxbt/status/1772843238539325947">wrote</a> on X following the incident.



Read more: <a href="https://blockworks.co/news/80-million-lost-orbit-bridge">$80M lost in first hack of 2024</a>



Users of Juice Finance, which designed a vault and bot system to play the game and <a href="https://x.com/Juice_Finance/status/1771961847593242730?s=20">earn</a> valuable points at an accelerated rate, were also at risk, according to Chief Operating Officer Eric Ryklin.&nbsp;



The Juice team independently reviewed Munchables’ code, a prerequisite for launching its own product.



“The malicious <a href="https://blockworks.co/tag/exploit">exploit</a> was not in their code,” Ryklin told Blockworks. “Nor is it in their actual <a href="https://blockworks.co/tag/audit">audit</a> itself.”



“This guy pushed an upgrade that no one could have seen — it was unverified — and it essentially gave him three wallets that had unlimited access to withdraw funds, plus he had the keys to the upgrader and the main deployer wallet,” he said.



Read more: <a href="https://blockworks.co/news/audits-cannot-guarantee-defi-exploits">Latest DeFi exploits show audits are no guarantee</a>



Juice and Munchables shared several investors, and both teams were in touch with each other regularly in the runup to the theft, Ryklin said. The malicious actor, who worked for Munchables, was a member of a group chat that included the Juice team.



“They met this guy in a developer Discord somewhere across the space,” Ryklin recalled, and after the hack it emerged that the team was not the actual owner of their contracts.



“Someone from their HR team messed up big time,” blockchain security firm SlowMist <a href="https://x.com/SlowMist_Team/status/1772802698934423994?s=20">said</a> on X.



Ryklin described it as a “sleeper cell,” and ZachXBT <a href="https://x.com/zachxbt/status/1772846846156870040?s=20">pointed</a> to <a href="https://blockworks.co/news/north-korea-defi-hacks">North Korean hackers as likely responsible</a>.



“This guy inserted three sleeper wallets into the actual contract that no one could find at first,” Ryklin said. “But the second that he would do a transaction, that sleeper wallet would become public, so the <a href="https://blockworks.co/tag/blast">Blast</a> sequencer could essentially blacklist him.”



ZachXBT declined to comment on how he arrived at that conclusion.&nbsp;



A spokesperson for security firm CertiK told Blockworks “it’s highly unusual that the funds were then returned to the project from a malicious DPRK affiliated worker” — referring to agents of the North Korean government — and that the firm assessed it could be “a rogue developer,” who, with their identity revealed, “decided to give the funds back after pressure from the Web3 community to prevent further backlash.”



“Obviously, seeing the funds returned is abnormal behavior,” ZachXBT told Blockworks.



In any case, quickly recognizing those wallets proved crucial to securing the return of the stolen funds.



Read more: <a href="https://blockworks.co/news/solana-exploit-dao-hacker">DAO on Solana loses $230K after ‘attack proposal’ goes unnoticed</a>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">$97m has been secured in a multisig by Blast core contributors. Took an incredible lift in the background but I’m grateful the ex munchables dev opted to return all funds in the end without any ransom required. <a href="https://twitter.com/_munchables_?ref_src=twsrc%5Etfw">@_munchables_</a> and protocols integrating with it like <a href="https://twitter.com/Juice_Finance?ref_src=twsrc%5Etfw">@juice_finance</a>…&mdash; Pacman | Blur + Blast (@PacmanBlur) <a href="https://twitter.com/PacmanBlur/status/1772871466935013701?ref_src=twsrc%5Etfw">March 27, 2024</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



With the jig up, and no way to exfiltrate the funds, the attacker made it easier on the Blast team by <a href="https://x.com/_munchables_/status/1772859898897777016">handing</a> over their private keys.



That avoided the need to employ more technical solutions.



“Blast could have definitely pushed a soft fork to literally just blacklist his wallet and pull the money out,” Ryklin said, “I think at that point, it&#8217;s like, ‘Why would he not give the keys back?’”



The hacker was not able to take 7349.99 wrapped ether, worth about $25 million at the time, as a result of an apparent typo. It was what Juice’s auditor, Trust Security, <a href="https://x.com/trust__90/status/1772963433408795131?s=20">called</a> “one of the weirdest side stories of the Munchables exploit.”



Instead of snatching all the wrapped ether, the attacker took just 73.49 wETH (about $267,000).



“The hacker was off by two 0s when inputting the amount! It is easy to confirm in a simulation that they could have indeed taken the whole vault,” Trust said. “It must have taken the hacker over eight minutes to realize their mistake, which is when the team paused withdrawals.”



CertiK confirmed to Blockworks this was the most plausible explanation for the data.



None of Juice’s other vaults or its own <a href="https://blockworks.co/tag/smart-contracts">smart contracts</a> were affected, the team <a href="https://twitter.com/Juice_Finance/status/1772752884725088454">said</a>.



The hacker also missed the chance to grab an additional $7 million in USDB, Blast’s interest bearing <a href="https://blockworks.co/tag/stablecoins">stablecoin</a>, which was secured before it could be stolen, Ryklin said.



“The bridges got closed, so the money was contained,” he said.



That meant that, unlike in other <a href="https://blockworks.co/tag/hack">hacking</a> cases, the thief had no leverage. The fact that Blast has multiple centralized components meant that there would be no chance to try to launder the proceeds.



Read more: <a href="https://blockworks.co/news/blast-developers-layer-2-liquidity">Blast developers drawn by layer-2’s liquidity and founder’s success building Blur</a>



That may <a href="https://x.com/SamridhSaluja/status/1772765988125286500?s=20">trouble</a> some “decentralization maxis,” but Ryklin finds it completely normal at this stage of the network’s development.



“I think the reason that you were able to successfully recover $97 million instead of everyone losing their money is because there are guardrails in place, and I don&#8217;t think those are the worst things in the world,” he said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Blast dapp hack was an inside job, and it could have been worse

Katherine Ross

Jack Kubinec

Following Ethereum’s Dencun upgrade, the Blast Mainnet stopped producing blocks.&nbsp;



Around an hour after the last block was produced, Blast said that the issue was resolved in a post on X.&nbsp;



“A full analysis on the issue will be shared shortly,” the team said in the post.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Update: the issue has been resolved. A full analysis on the issue will be shared shortly. <a href="https://t.co/Ggw05W3g3b">https://t.co/Ggw05W3g3b</a>&mdash; Blast (@Blast_L2) <a href="https://twitter.com/Blast_L2/status/1767933586487890427?ref_src=twsrc%5Etfw">March 13, 2024</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



“The Blast Mainnet has stopped producing blocks due to issues related to Ethereum’s Dencun upgrade,” Blast said in a post on X. “Core engineering contributors are working on a fix. We’ll share an update and post-mortem once the fix is live…”



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">The Blast Mainnet has stopped producing blocks due to issues related to Ethereum’s Dencun upgrade. Core engineering contributors are working on a fix. We’ll share an update and post-mortem once the fix is live (eta 30-60 min).&mdash; Blast (@Blast_L2) <a href="https://twitter.com/Blast_L2/status/1767924021872455902?ref_src=twsrc%5Etfw">March 13, 2024</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Ethereum’s Dencun <a href="https://blockworks.co/news/ethereum-dencun-upgrade-mainnet">upgrade went live early Tuesday</a>, marking the network’s largest upgrade to date.&nbsp;



<a href="https://blastscan.io/">According</a> to Blast Scan, blocks stopped publishing around 10 am ET.



Read more: <a href="https://blockworks.co/news/blast-developers-layer-2-liquidity">Blast developers drawn by layer-2’s liquidity and founder’s success building Blur</a>



The “[layer-2] with native yield” drew criticism for initially soliciting deposits to a multisig wallet. All told, it saw <a href="https://blockworks.co/news/blast-optimistic-rollup-launch">$2.3 billion in deposits</a> before its layer-2 went live. The layer-2, which went to mainnet in late February, is a fork of <a href="https://blockworks.co/tag/optimism">Optimism</a>. As of Wednesday morning, Blast had <a href="https://defillama.com/chains/Rollup">surpassed</a> Optimism as the second-largest Ethereum rollup by total value locked (<a href="https://blockworks.co/tag/tvl">TVL</a>), according to DeFiLlama. The 51 protocols built on Blast cumulatively <a href="https://defillama.com/chain/Blast">held</a> over $1 billion.&nbsp;



Optimism itself <a href="https://optimistic.etherscan.io/">continued</a> producing blocks through the Dencun upgrade. 



<a href="https://blockworks.co/tag/blast">Blast</a> said over 3,000 projects entered its developer contest to go live upon the layer-2’s mainnet launch and receive a larger <a href="https://blockworks.co/tag/airdrop">airdrop</a> allocation. Developers on Blast told Blockworks they were drawn to the rollup’s deep liquidity and its founder’s previous success building the NFT marketplace Blur.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Blast stopped producing blocks following Ethereum’s Dencun upgrade

When the heavily-marketed layer-2 Blast went to mainnet late last month, so did a host of protocols built atop the optimistic rollup.&nbsp;



Blast drew over $2 billion in deposits before launching — but faced criticism for initially soliciting the funds to a multisig wallet before its layer-2 had been built. A number of protocols were willing to brush that aside, though: DeFiLlama <a href="https://defillama.com/chain/Blast">lists</a> 50 protocols deployed on Blast cumulatively holding nearly $1 billion in total value locked (<a href="https://blockworks.co/tag/tvl">TVL</a>).&nbsp;



Blast <a href="https://twitter.com/Blast_L2/status/1761246464200826945">said</a> over 3,000 projects entered its “Big Bang” developer contest to go live on mainnet launch and receive a larger allocation of the protocol’s airdrop.



Read more: <a href="https://blockworks.co/news/blast-layer2-ethereum-yield">Wannabe L2 Blast bursts onto scene promising high ETH yield — in 3 months</a>



Among the developers Blockworks spoke to about building on Blast, a couple major draws that emerged were the protocol’s success in acquiring users and liquidity, as well as founder Tieshun Roquerre’s established track record with the NFT marketplace Blur.



<a href="https://blockworks.co/news/blast-tvl-ethereum">Blast first pitched itself</a> as a layer-2 with “native yield” — meaning holdings <a href="https://docs.blast.io/about-blast#auto-rebasing">are</a> compounded on yield-generating venues like Lido and MakerDAO. The rollup is a <a href="https://github.com/blast-io/deployment">fork</a> of the second-largest layer-2, Optimism.&nbsp;



The metaverse-adjacent protocol Entertainm was partly motivated to build on Blast by the native yield and Blast’s pledge to <a href="https://docs.blast.io/building/guides/gas-fees">reimburse</a> some gas fees to developers. Entertainm can stake the reimbursed fees to grow its treasury, the project’s pseudonymous chief marketing officer Renata said in a direct message.&nbsp;



Vertex, an Arbitrum-native decentralized exchange (DEX), made Blast its first cross-chain deployment. Its forked DEX, called Blitz, doesn’t even let users trade yet — but that hasn’t stopped over $15 million in TVL from being bridged to the protocol from roughly 5,000 unique wallets, Vertex co-founder Darius Tabai said.&nbsp;



Tabai said Vertex began considering deploying on Blast after seeing the user excitement surrounding the layer-2. This was particularly true in Asia, where Vertex has a strong presence. Tabai was also drawn to Blast’s founder Roquerre, known online as Pacman.&nbsp;



Roquerre has “much more of a successful Web2 founder-type mentality than some of the more academic outlook that can exist in blockchain. And I think we&#8217;re sort of attracted to that kind of pragmatism. ‘Build things that people want to use and get them to use it’ is a way more exciting story to us than ‘be 10% better on TPS [transactions per second],’” Tabai said.&nbsp;



Currently in his mid-twenties, Roquerre <a href="https://tieshunroquerre.com/">went</a> through the famous startup incubator Y Combinator as a teenager before enrolling in and dropping out of MIT. In 2022, he co-founded an NFT marketplace named Blur that <a href="https://dune.com/hildobby/NFTs">unseated</a> OpenSea as the largest NFT marketplace by trading volume.&nbsp;



Read more: ​​<a href="https://blockworks.co/news/blur-blends-defi-nfts">Blur blends DeFi and NFT market with new lending platform</a>



Blur grew partly through a “points” system where users were given IOUs <a href="https://x.com/blur_io/status/1726755896708190479?s=20">for</a> bidding, listing, or lending on the platform. Users’ points determined their allocation in Blur’s eventual token airdrop.&nbsp;



Some of Blur’s volume spike has also been <a href="https://blockworks.co/news/blur-nft-volume-crypto-airdrop">attributed to wash trading</a>, where users sell NFTs to themselves to do things like drive up prices or farm for points allocations.&nbsp;



Much of the depositing frenzy on Blast has been driven by a points system similar to Blur’s. Blast <a href="https://blast.io/en/about?utm_source=thedecentralised.beehiiv.com&amp;utm_medium=newsletter&amp;utm_campaign=prepare-for-a-2bn-blast">says</a> on its website some sort of Airdrop will be distributed to points holders in May.&nbsp;



One founder deploying a project on Blast said they started building on the protocol partly as a bet that Roquerre would repeat the success he saw at Blur. Blast’s deep liquidity — it has nearly already surpassed <a href="https://blockworks.co/tag/optimism">Optimism</a> as the second-<a href="https://defillama.com/chains/Rollup">largest</a> Ethereum rollup by TVL, per DeFiLlama — was also a draw.&nbsp;



Despite any qualms with the tech, demand for Blast was clearly present.&nbsp;



“Initially I was like, ‘Oh wow, this is crazy.’ But as the number goes up, and as people still commit their funds…I mean, personally, I did not deposit on Blast. But you know, as other people do it, I&#8217;m like, ‘Okay, as a developer, if there is demand of people willing to take that risk, then I can be offering a product on that chain,’” they said.



Read more: <a href="https://blockworks.co/news/blast-optimistic-rollup-launch">Blast launch leaves users confused about withdrawals</a>



The founder mentioned that the participation of <a href="https://blockworks.co/tag/paradigm">Paradigm</a>, a well-regarded crypto venture capital firm, increased their confidence in the project. 



Paradigm <a href="https://x.com/Blast_L2/status/1726747087906464024?s=20">participated</a> in Blast’s $20 million November seed round. Days later, Paradigm head of research Dan Robinson <a href="https://twitter.com/danrobinson/status/1728817674543862023">wrote</a> on X that Blast’s launch “crossed lines in both messaging and execution.” In December, Robinson <a href="https://twitter.com/danrobinson/status/1733187417694486541">said</a> the VC firm worked with Blast to redesign its upgrade system and “set a better precedent for future projects who may try to emulate them.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Blast developers drawn by layer-2’s liquidity and founder’s success building Blur

Blast launched its optimistic rollup late Thursday, fulfilling a pledge to allow users to withdraw funds locked in a team multisig for over three months.



The value of user deposits crept up to nearly $2.3 billion by launch time. Now users have a choice: withdraw or find something to do with the funds on the newly launched layer-2.



Data from DefiLlama early Friday showed that the balance of the Blast bridge contract had plummeted by about 70%, which CoinDesk <a href="https://x.com/CoinDesk/status/1763570162853089483?s=20">reported</a> as “$1.6 billion outflows.”



The actual amount of withdrawals is not that clear-cut. Funds are moving out of the deposit <a href="https://etherscan.io/address/0x5f6ae08b8aeb7078cf2f96afb089d7c9f51da47d#tokentxns">contract</a> at a healthy clip, but the capital — mostly Lido staked ether (<a href="https://blockworks.co/tag/steth">stETH</a>) — are <a href="https://platform.arkhamintelligence.com/explorer/address/0x98078db053902644191f93988341E31289E1C8FE">moving</a> into Blast’s ETH Yield Manager Proxy — not leaving the network as a result of user withdrawals.



Read more: <a href="https://blockworks.co/news/3-years-launch-eth-staking">Blast from the past: 3 years on from the launch of ETH staking</a>



Certainly, some withdrawals are to be expected, given that ether (<a href="https://blockworks.co/price/eth">ETH</a>) has run up about 70% since Blast invited users to lock up their capital for over three months in exchange for a points IOU.&nbsp;



Many depositors appear to be jumping at the chance to reclaim their funds, based on dozens of discussions in the Blast Discord channel. However, some say they were unaware of the delay period required to use Blast’s bridge back to <a href="https://blockworks.co/tag/ethereum">Ethereum</a>.



<figure class="wp-block-image"><img decoding="async" src="https://lh7-us.googleusercontent.com/FzWW82xg4ZVaI0qwhmL6tiMWFxWAJc5Q7aNcNf1QXkRLXrM0SndKCEVhcUbJotVTWDRACbL7RA3Q6aCJ1dxyrSQqUrSvzYZwfTPX9zdtqOnWmCG5Xm5RZuS0Il6fLhVSEj0omEswkJGDHiZDRig6W1Y" alt=""/></figure>



Complaints such as these can be found in the Blast Discord since launch



Due to the particulars of Blast’s optimistic <a href="https://blockworks.co/tag/rollups">rollups</a> design, depositors must wait 14 days and pay Ethereum gas fees to move their deposits back to mainnet. Optimistic rollups, like OP Mainnet, <a href="https://help.optimism.io/hc/en-us/articles/4411908369563-Do-I-have-to-wait-7-days-to-get-my-funds-out">typically</a> have a seven-day withdrawal delay. Known as the challenge period, this delay allows for the submission of fraud proofs to ensure the integrity of transactions before they are finalized.



The Blast developer documentation says the extended period is a “security feature designed to help secure Blast.” Blockworks has reached out to Blast representatives for clarification.



Dedicated third-party bridge <a href="https://blockworks.co/tag/dapps">dapps</a> may offer faster transfers, but for a fee. For instance, Orbiter charges 1.5% for the privilege.



Blast has been a marketing phenomenon up to now. Spearheaded by NFT dapp Blur founder Tieshun Roquerre, known by his online moniker “Pacman,” it launched with great fanfare last November. Backed by serious investors and promoted by widely followed influencers, all while any semblance of working project was months away.



Read more: <a href="https://blockworks.co/news/blast-tvl-ethereum">Blast TVL hits $390 million, with no product</a>



Since then, it hired developers, <a href="https://blockworks.co/news/optimism-bedrock-upgrade-superchain">forked the OP stack</a>, and continued to gain users lured by the promise of Blast points in addition to ETH staking yield.



85,000 accounts have access to the Blast Discord, and the team incentivized scores of independent developers to build on the platform through its Big Bang <a href="https://blast.io/en/bigbang">campaign</a>.



57,000 wallets have interacted with the chain since the layer-2 when live, <a href="https://flipsidecrypto.xyz/rezarwz/blast-observatory-LXDBd4">data</a> shows. About $40 million is now <a href="https://defillama.com/chain/Blast">tracked</a> in DeFi dapps by DefiLlama, mostly borrowing and lending market ZeroLend, an Aave v3 fork.



But it has also been beset by rug-pulls. At least six of the many meme coins launched so far have been scams that became worthless, Dexscreener <a href="https://dexscreener.com/blast">shows</a>.



Read more: <a href="https://blockworks.co/news/chainalysis-rug-pull-report">Average potential crypto rug pull makes $2,600 in profit: Chainalysis</a>



One, a gambling project aptly called RiskOnBlast, <a href="https://twitter.com/wublockchain/status/1761673654059106486">absconded</a> with 420 ether, worth more than $1 million raised in a token sale ahead of the Blast launch.



Assuming Blast retains at least $1.88 billion of the deposits received, it will be the <a href="https://l2beat.com/scaling/summary">third-largest</a> layer-2 network on Ethereum, a remarkable feat.



Can Blast carve out its own niche in an increasingly crowded Ethereum rollup market?



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Blast launch leaves users confused about withdrawals

After nine months in development, Ethereum layer-2 network Mantle has launched its second core product, Mantle Liquid Staking Protocol (LSP).



This new protocol, deployed on Mantle and Ethereum mainnet, introduces a non-custodial and permissionless ether liquid staking solution, Mantle Staked Ether (mETH).



METH acts as a value-accumulating receipt token within the Mantle LSP, very similar to Lido’s staked ether (<a href="https://blockworks.co/price/steth">stETH</a>). Mantle aims to achieve the highest sustainable core yield by exploring maximal extractable value. It also shares yield from the Mantle treasury, according to a statement released Monday.



The idea for mETH came from Mantle “alchemist” Jordi Alexander, chief information officer at Selini Capital.



“We&#8217;ve just created a lighter weight, more modern Lido,” Alexander told Blockworks. He champions the idea of offering a native staking yield on an <a href="https://blockworks.co/tag/ethereum">Ethereum</a> layer-2. The premise is “we should do all of DeFi, but first start by having the 5% yield,” he explained.



This is the same promise of <a href="https://blockworks.co/news/3-years-launch-eth-staking">the planned Blast layer-2</a>, which has attracted deposits of ether (<a href="https://blockworks.co/price/eth">ETH</a>) and stablecoins now <a href="https://dune.com/0xramen/blast-stats">topping</a> $750 million over the past two weeks.



Blast, despite its rapid growth and ambitious plans, faces scrutiny over its security model and the centralization concerns related to its reliance on <a href="https://blockworks.co/tag/lido">Lido</a>.



Read more: <a href="https://blockworks.co/news/lido-centralization-debate-ethereum">Did Lido fly too close to the sun? Inside the centralization debate</a>



“Kudos to the Blast team because it&#8217;s the same idea that I had but just a very different implementation,” said Alexander, who has been advising Mantle since March and serves on investment and treasury committees.



“I was pretty excited [when Blast launched] because they&#8217;re educating the market on this idea” of having native staking yield available for DeFi on a layer-2, he said.



The Mantle LSP development process represents a more traditional, structured approach with a focus on security and integration within its ecosystem.



The team decided to build a solution from scratch, but also talked to Lido about the idea of white labeling their infrastructure.



“We talked to everybody — we literally went through every single [<a href="https://blockworks.co/tag/liquid-staking">liquid staking</a> team] out there —&nbsp;including Lido of course — we had multiple chats with them to decide [if] there [is] a way that we can take the easy way out,” Alexander said, adding “we decided to go the hard route, and it&#8217;s taken many months to do it properly and get all the audits and everything.”



The various components of the Mantle LSP have been <a href="https://docs.mantle.xyz/meth/security/audits">audited</a> by Hexens, MixBytes, Secure3 and Verilog, and the contract upgradeability is the responsibility of the Mantle <a href="https://docs.mantle.xyz/meth/security/roles#mantle-security-council">Security Council</a>, a 6 of 12 multisig, which is also used for maintenance of the Mantle Network itself.



“If you trust Mantle, it’s the same security,” Alexander said.



Unlike Blast, Mantle LSP doesn’t force anyone to stake or bridge. METH will work just fine on Ethereum mainnet and Alexander stressed that it is an independent product from the Mantle Network.



“There&#8217;s some people that just want to stay on [Ethereum] mainnet and we do want to cater to them as well,” but, he adds, “I expect that most of it eventually will get incentivized to move because we&#8217;ll make it really juicy to ship it over.”



These incentives can be seen as a vampire attack on Lido, which Alexander says should appeal to members of the Ethereum community concerned over excessive Lido centralization.



<h2 class="wp-block-heading">What’s cooking in “the mETH lab”?</h2>



The Mantle team has a number of ideas in the works to expand upon the LSP’s use within its network, which will be proposed to holders of the MNT governance token in the coming weeks.



MNT is also used to pay transaction fees on the Mantle Network.



Alexander originally considered mETH as a good candidate for the Mantle gas token — “like a self-replenishing gas,” he said — but ultimately <a href="https://blockworks.co/news/mantle-network-readies-mainnet">Mantle’s mainnet launch schedule</a> led to the introduction of MNT.



The team might consider a dual gas token model, make use of <a href="https://blockworks.co/news/account-abstraction-blocknative">account abstraction to reduce user friction</a>, or outline other new utilities for MNT.



“I think we&#8217;re going to have it be sort of like ATOM where you get airdrops and it&#8217;s kind of like a launch pool token,” Alexander said, referring to the native asset of the <a href="https://blockworks.co/tag/cosmos">Cosmos Hub</a>.



He agrees with the critique that Ethereum has too many layer-2 networks proliferating, suggesting that most lack a creative new idea.



“Is there something unique or some imagination that&#8217;s gone into it instead of just deploying a tenth version of Aave and just doing the same USDT pair or whatever?” he asked rhetorically. And as for the name and its natural association with illicit drugs?



“We&#8217;re going to try to just lean into it. I&#8217;m going to launch an unofficial meme contest on my Twitter.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Mantle offers ‘mETH’ to the masses, as a ‘lighter weight Lido’

Yeeting ETH into the void is nothing new for Ethereans.



By the time the Beacon Chain officially launched on Dec. 1, 2020, the staking contract — referred to as “ETH 2.0” back then — had already seen around 880,000 ETH in deposits.



So perhaps it’s no surprise that <a href="https://blockworks.co/news/blast-tvl-ethereum">multisig-with-a-plan project</a> Blast now sports $650 million in staked ether and stablecoins under its control.



Blast’s explicit promise is that deposited tokens will earn an on-chain yield, plus rewards of unknown value. Ether staking yield comes via Lido’s <a href="https://blockworks.co/price/steth">stETH</a> tokens, while stablecoins are converted to <a href="https://blockworks.co/price/dai">dai</a> deposited in Maker, or <a href="https://blockworks.co/news/maker-endgame-sub-dao-governance-gnosis-dai">savings dai</a> (sDAI).



On Thursday it <a href="https://twitter.com/0xSEM/status/1730291178229186586?s=20">emerged</a> that the Blast deposit interface set its slippage tolerance to an inordinately high 10%, resulting in one user losing about $100,000 in value. The Blast team <a href="https://x.com/Blast_L2/status/1730294341447331973?s=20">says</a> they’ve fixed it.



But, <a href="https://blockworks.co/news/sandwich-attack-mev-ethereum">sandwich attack</a> surprises aside, most depositors at least know that all assets will be locked until the proposed <a href="https://blockworks.co/news/ethereum-optimistic-rollups">optimistic rollup</a> launches in February.



Depositors to the Beacon Chain, too, knew that their ether would be locked up for at least a couple of years — though it wasn’t clear when exactly <a href="https://blockworks.co/tag/ethereum-merge">The Merge</a> and subsequent enabling of <a href="https://blockworks.co/tag/shanghai-upgrade">staking withdrawals</a> would happen when many aped in.



Ultimately it took until April 2023, by which time about 18 million ETH (about $33 billion at the time) were deposited.



In the interim, there was a rapid <a href="https://dune.com/hildobby/eth2-staking">growth</a> in liquid staking, with <a href="https://blockworks.co/tag/lido">Lido</a> becoming the dominant player in early 2022, and already nearing a third of all staked ether by May 2022. It has remained between 29% and 33% ever since, keeping the project at the <a href="https://blockworks.co/news/lido-centralization-debate-ethereum">center of a debate</a> about centralizing market forces on Ethereum.



The total percentage staked through Lido currently <a href="https://dune.com/hildobby/eth2-staking">stands</a> at 32.28%, and Blast — which uses Lido exclusively — isn’t helping.



How much of a problem that is, depends on who you ask.



Some will analogize the concentration of ether stake to the preponderance of the Go Ethereum (Geth) execution client for Ethereum node operators. A great deal of social coordination was needed to bring down the market share of <a href="https://blockworks.co/news/ethereum-devs-finality-issue">Prysm on the consensus layer</a>, which reduces risks to the network as a whole. Geth is <a href="https://clientdiversity.org/#distribution">currently</a> at 84%.



Client diversity is widely seen as one of Ethereum’s strengths, a hallmark of its resilience through decentralization, which is unmatched in crypto. Indeed, decentralization and resilience are often seen as synonymous.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">We learned a BIG lesson during consensus client diversity: The usual activity is for the ~10% of home stakers to bust their asses trying to change the distribution, but the REAL value is in getting large providers to switch. Don&#39;t focus on home stakers, focus on large entities.&mdash; superphiz.eth 🦇🔊🛡️ (@superphiz) <a href="https://twitter.com/superphiz/status/1730566752285638709?ref_src=twsrc%5Etfw">December 1, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



That’s why <a href="https://twitter.com/evan_van_ness/status/1727753087941542109?s=20">some</a> are concerned about the Blast-fueled tick up in Lido’s stake share.



But for others, it’s a feature, not a bug. Blur and Blast investor <a href="https://debank.com/profile/0xaa7577a7A27aa7FcF6d0eC481B87Df3aD0F6a88E">Izebel.eth</a> stated the “3 line pitch” for Blast is that “[Ethereum] would be better if everyone used stETH…so we use the bridge as a forcing function.”



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">3 line pitch: eth would be better if everyone used steth &amp; rebasing stables natively but its an impossible coordination problem so we use the bridge as a forcing function&mdash; jez (blast era) (@izebel_eth) <a href="https://twitter.com/izebel_eth/status/1726783944836751800?ref_src=twsrc%5Etfw">November 21, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Of course, the “bridge” is not really a bridge, while it can only be <a href="https://blockworks.co/news/blast-layer2-ethereum-yield">crossed one way</a>. And forcing people into a harmful position isn’t doing them any favors.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">lmao @ ppl saying &quot;why didn&#39;t L2s research a mechanism like blast before?&quot; we did it sucks&mdash; pseudo 📜🇺🇦 (@pseudotheos) <a href="https://twitter.com/pseudotheos/status/1727679237455306878?ref_src=twsrc%5Etfw">November 23, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



It’s generally good advice to be wary of promises from <a href="https://twitter.com/naniXBT/status/1727427129824969037?s=20">backers</a> that something can “reshape the fabric of society.” That’s not just “ambitious” — it’s hubris.



None of the more academic discussions ultimately matter, though, when you have gamification as your <a href="https://x.com/Brentsketit/status/1727097507895988650?s=20">selling</a> point. And, maybe there are <a href="https://x.com/Fiskantes/status/1730522904918462602?s=20">bigger fish</a> to fry.



In any case, Lido has more TVL — <a href="https://defillama.com/protocol/lido">approaching</a> $20 billion — than any other DeFi protocol by a country mile. And Blast is bigger than <a href="https://blockworks.co/tag/base">Base</a> — in third place behind Arbitrum and Optimism <a href="https://l2beat.com/scaling/summary#active">according to</a> L2Beat — while now <a href="https://twitter.com/Blast_L2/status/1730362088583835913">hiring</a> software engineers, much to the <a href="https://x.com/MeltedMindz/status/1730628148893806762?s=20">amusement</a> of crypto Twitter.



Plenty of folks in this industry idolize the free market; so if that’s your modus operandi, then the market has spoken, for now.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Blast from the past: 3 years on from the launch of ETH staking

In just a few days, the amount of value sent into the Blast deposit contract on Ethereum has increased by an order of magnitude to $390 million.



A smart contract, advertised as a “bridge” for a yet-to-be-developed optimistic rollup, has received about $340 million in ether and $50 million in stablecoins since launching Monday.



The <a href="https://etherscan.io/address/0x5f6ae08b8aeb7078cf2f96afb089d7c9f51da47d">contract</a> is controlled by a <a href="https://app.safe.global/settings/setup?safe=eth:0x67CA7Ca75b69711cfd48B44eC3F64E469BaF608C">Safe 5-key multisig</a> where 3 keys are required to execute transactions. However, one of the 5 keys has no transaction history, and the other 4 show initial ether deposits from the same Ethereum <a href="https://etherscan.io/address/0x62abcf00d56057edcbcd8122dc06ab6a1fa643dd">account</a>.



There is no way for an outside observer to know whether the five keys were generated by five independent entities or people.



A thread on X from Blast <a href="https://x.com/Blast_L2/status/1728096111313973317?s=20">claims</a> they are using best practices, and that the signers &#8220;are deeply technical engineers who have experience with high stakes applications ranging from financial applications to smart contracts.&#8221;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">You want to make sure that each signing key of a multisig is independently secure. This helps make the multisig antifragile. Each key should be in cold storage, managed by an independent party, and geographically separated.&mdash; Blast (@Blast_L2) <a href="https://twitter.com/Blast_L2/status/1728096108378025998?ref_src=twsrc%5Etfw">November 24, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Development of the project, backed by VC firms Paradigm and Standard Crypto, along with a slew of influential <a href="https://twitter.com/mrjasonchoi/status/1726830156545994959/photo/1">crypto personalities and traders</a>, is being spearheaded by <a href="https://blockworks.co/tag/blur">Blur</a> co-founder, Tieshun Roquerre who goes by the pseudonym “Pacman.”



The <a href="https://x.com/PacmanBlur/status/1628223380314001408?s=20">former</a> Thiel Fellow and <a href="https://tieshunroquerre.com/">MIT dropout</a> previously told Blockworks that the project uses “the same security model” as other L2s specifying Optimism, Polygon, and Arbitrum.



However, each of these networks, while not fully trustless, has additional security components besides a multisig. For instance, Arbitrum has a publicly elected “security council” with 12 members, only two of which are on the <a href="https://blockworks.co/tag/offchain-labs">Offchain Labs</a> development team.



Blockworks contacted Paradigm and Standard Crypto and Pacman for clarification.



Deposited ether cannot be withdrawn until February 2024, when the development team must modify the deposit contract, presumably alongside the launch of an actual rollup.



Ethereum layer-2 tracker L2BEAT lists the project in it’s “<a href="https://l2beat.com/scaling/summary#upcoming">Upcoming</a>” section, but were it active today it would rank between zkSync Era, which launched mainnet in October 2022, and dYdX V3 the StarkEx rollup that has been active since April 2021.



<figure class="wp-block-image"><img decoding="async" src="https://lh7-us.googleusercontent.com/PVUJako77FavDnqoiTYlTrj0sPNQvQrbkUG0sEYcExADFS16O0xNPE-VJ7_Ky8c1-zwACTHspHhHW9Z9q54FAdgmzSvPVdrkyFURSTBLyrmxm1ZySD2pzaB_Tk1GUkeWu9om6ped5WAWqnk54_LW-NA" alt=""/></figure>



Active Ethereum L2s; Source; <a href="https://l2beat.com/scaling/summary#active">L2BEAT</a>



One depositor tossed 10,000 ETH, worth $21 million at the time, into the contract in a <a href="https://etherscan.io/tx/0x1e701748ca280f83fbf9d3432d7ab2df14fc82af4acd69049bb34fbdf80914b6">single transaction</a>.



<h2 class="wp-block-heading">“Collective brain of Crypto Twitter” weighs in</h2>



Many crypto observers have expressed surprise at Blast&#8217;s rapid growth in the face of uncertain risks.



Blast has touted on its X account that ether staking represents “risk-free return,” a view which Lido DAO members, including Blast investors, have expressed lacks nuance.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">important to clarify that this statement is false. while i am of the opinion that staking needs to be made as close to risk-free as possible, we are not there today. there are governance, contract, and operator risks involved. anyone using Blast needs to keep these in mind <a href="https://t.co/8z9dVJhr6J">https://t.co/8z9dVJhr6J</a>&mdash; sacha💧 (@sachayve) <a href="https://twitter.com/sachayve/status/1726992845431848990?ref_src=twsrc%5Etfw">November 21, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Orlando Cosme, founding attorney of OC Advisory, criticized the project, calling it an “onchain hedge fund” that is “proving regulators’ point.”



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Blast is proving regulators’ point. An onchain hedge fund controlled by a 3/5 anon multisig isn’t defi. It’s “trust me bro.” And centuries of “trust me bro” is why financial regs exist. Crypto’s value add—and why crypto needs diff regs—is trust reduction. We can do better.&mdash; orlando.btc (@Orlando_btc) <a href="https://twitter.com/Orlando_btc/status/1727738246401077737?ref_src=twsrc%5Etfw">November 23, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



A straw poll conducted by Tangent Ventures founder Jason Choi, seeking to tap “the collective brain of CT,” has garnered over 2,500 respondents. The unscientific opinion poll puts the odds of an exploit of the deposited crypto assets between now and February at 64%.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Will Blast bridge be exploited before February?&mdash; Jason Choi (@mrjasonchoi) <a href="https://twitter.com/mrjasonchoi/status/1727912768312115558?ref_src=twsrc%5Etfw">November 24, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Offchain Labs’ Chief Strategy Officer, A.J. Warner, noted Thursday <a href="https://x.com/ajwarner90/status/1727552749535941004?s=20">in an X post</a> that the Arbitrum development firm had considered a similar design but opted not to pursue it.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Btw, this doesn’t mean staking bridged funds is per se a bad idea. There are ways to manage/disclose risks etc. in theory. It’s just obvious that the way Blast is doing it isn’t how we would approach it.&mdash; A.J. Warner (💙,🧡) (@ajwarner90) <a href="https://twitter.com/ajwarner90/status/1727566510900588899?ref_src=twsrc%5Etfw">November 23, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Very few of the listed investors have publicly addressed criticisms of the project to date, though some <a href="https://x.com/Evan_ss6/status/1727161373950615693?s=20">claim</a> to have privately communicated concerns.



Dovey Wan, a Blast investor and Founder of Primitive.Ventures, <a href="https://x.com/DoveyWan/status/1727519384179294574?s=20">promoted</a> the project’s success attracting capital as having “pre-bull energy,” and “strong pumpanomics,” while hand waving away concerns over the security of funds, by acknowledging “it&#8217;s just a multisig managed by 5 [profile pics] online.”



Wan urged crypto users to “bridge for culture bridge for fun bridge for what you can afford to lose it all,” alongside the vacuous caveat that the promotion was “no FA DYOR” — not financial advice, do your own research.



Updated Nov. 24, 2023 at 12:37 pm ET with update from Blast on multisig.