Bessie Liu

<div id="highlights-block_63503e90e7211" class="highlights">
        <ul>
                <li>This vulnerability was not in Optimism’s code, but rather in a custom bridge provided by BitBTC</li>
                <li>BitBTC’s custom bridge code did not acknowledge the specific layer-2 token being minted to the layer-1 address</li>
            </ul>
    
</div>



<p>A Twitter user has helped avert a potential exploit after publicly flagging a vulnerability in BitBTC’s Optimism bridge — the latest such near-miss amidst a year full of “successful” thefts.&nbsp;</p>



<p>Lee Bousfield, a tech lead at Ethereum scaling solution Arbitrum — PlasmaPower0 on Twitter — published what he dubbed a critical exploit after he said his messages were ignored by BitBTC.&nbsp;</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">BitBTC&#39;s Optimism bridge is trivially vulnerable. Their team has ignored my messages, so I&#39;m going to publish the critical exploit here. 🧵<a href="https://t.co/onyN9SzBjt">https://t.co/onyN9SzBjt</a></p>&mdash; Lee Bousfield (@PlasmaPower0) <a href="https://twitter.com/PlasmaPower0/status/1582176532985880576?ref_src=twsrc%5Etfw">October 18, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>The BitBTC bridge to or from Optimism&#8217;s blockchain facilitates withdrawals of any token between layer-2 and a corresponding layer-1 wallet. But, the BitBTC code involved does not acknowledge what the layer-2 token actually is —and mints an arbitrary layer-1 to match. </p>



<p>“That means an attacker could deploy their own token on Optimism, give themselves all the supply, and set that token&#8217;s L1Token to the real BitBTC L1 address,” Bousfield tweeted.</p>



<blockquote class="wp-block-quote"><p><strong>&#8220;When the attacker withdraws their malicious token through the BitBTC bridge, it gives them real BitBTC tokens on L1,&#8221; he said.</strong></p></blockquote>



<p>Of note, the apparent vulnerability was not in Optimism’s code, but rather in a custom bridge facilitated by BitBTC, according to Kelvin Fichter, an Optimism developer. Meaning, he said, no assets other than BitBTC assets were at risk.</p>



<p>“We put a lot of time and energy into the standard bridge and I highly recommend using the standard bridge rather than rolling your own custom bridge unless you really know what you&#8217;re doing,” Fichter <a href="https://twitter.com/kelvinfichter/status/1582401761650036738" target="_blank" rel="noreferrer noopener">tweeted</a>.</p>



<p>The next day, an attacker — who claimed he was testing the code, tried to withdraw 200 billion BitBTC from Optimism.&nbsp;</p>



<p>The exploit was able to be stopped as the process of withdrawing the token from the bridge would have taken seven days, and BitBTC in the interim patched the vulnerability via a software update.</p>



<p>“The attacks will now fail when they arrive on L1. Thanks everyone for making noise and helping get this fixed,” Bousfield <a href="https://twitter.com/PlasmaPower0/status/1582549048292446210" target="_blank" rel="noreferrer noopener">tweeted</a>.</p>



<p>Bousfield did not immediately return a request for comment.</p>



<hr class="wp-block-separator">
<p><strong>Get the day’s top crypto news and insights delivered to your inbox every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.</strong></p>
<hr class="wp-block-separator">


How Twitter Helped Avert a Critical Exploit

<div id="highlights-block_62a11c5d87f7a" class="highlights">
        <ul>
                <li>A hacker has acquired 20 million Optimism governance tokens intended for a loan</li>
                <li>The attacker has since transferred or sold about one million tokens — but that’s likely just the start</li>
            </ul>
    
</div>



<p>The airdrop of first-time governance tokens from Ethereum scaling solution Optimism has gone awry in a major way — thanks to a third-party the collective tapped to provide liquidity.</p>



<p>All told, about 20 million Optimism governance tokens (OP) that were loaned to facilitate transactions were lost, with cryptocurrency market maker Wintermute taking responsibility for the lapse.</p>



<p>The loan was initially deployed on Wintermute’s wallets on Optimism, but Wintermute CEO Evgeny Gaevoy said in a <a href="https://gov.optimism.io/t/message-to-optimism-community-from-wintermute/2595" target="_blank" rel="noreferrer noopener">statement</a> that “we made a serious error.” </p>



<p>Here’s what happened: The wallet address Wintermute used to receive the loan was inaccessible, because it relied on Ethereum layer-1 multi-signature technology that had yet to be deployed to Optimism, which runs as a layer-2. A layer-1 is the foundational function of a given blockchain, while layer-2s are built on top, typically to provide new features or liquidity.</p>



<p>A hacker, meanwhile, took advantage of the technological lapse to transfer the 20 million OP tokens from layer-1 to layer-2, even as Wintermute scrambled to recover the in-limbo funds. The attacker, however, had as of publication only liquidated about a million of the stolen tokens.&nbsp;</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">More important is what they knew and when. They knew about this on May 30th. There was a 15 hour gap between the test transaction of 1 <a href="https://twitter.com/search?q=%24OP&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$OP</a> and the following transaction. They didn&#39;t notice something was wrong? They knew 1 million was dumped on 6/5. Did exchanges know about this?</p>&mdash; Benjamin Singer (@BenjaminSinger8) <a href="https://twitter.com/BenjaminSinger8/status/1534657594836627457?ref_src=twsrc%5Etfw">June 8, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>“L1 is confusing enough for most people to navigate, and L2 brings a new set of paradigms over key management and safety, even for experienced crypto users and teams,” Gaevoy said.&nbsp;</p>



<p>“We are not sure why they chose not to liquidate all of it at once,” Gaevoy said. “There is hope that it is a white hat exploit, in which case the remaining funds are potentially recoverable. However we are currently operating under the premise that it is not the case, since we haven’t received any communication from them and our message on the chain was left unanswered.”</p>



<p>The attacker still owns 19 million OP tokens. Wintermute said the company plans to buy back the tokens once the attacker sells, saying the purchase “can potentially create price volatility in the token,” but that the market maker will “make best efforts to smoothen the effect.”</p>



<p>The Optimism Foundation has not chosen to update its network — likely requiring a hard fork — to halt the movement of stolen OP tokens that have not yet been stolen or sold as the foundation believes that “using centralized control to attempt a partial recovery would set a significant precedent.”</p>



<p>Security flaws and the illicit process of attaining cryptoassets have become a common problem for many platforms, and <a href="https://cms.blockworks.co/bipartisan-crypto-bill-hits-congress-with-focus-on-cftc-jurisdiction-taxes/" target="_blank" rel="noreferrer noopener">lawmakers are eager</a> to look for solutions.</p>



<p>It comes down to the hallmark phrase, “Not your keys, not your coins,” Ashton Wolfe, the project lead of Crypto Fight Club, told Blockworks.</p>



<p>“Of course, to protect people&#8217;s assets, governments will think that continuously hammering down on regulations will fix this solution,” Wolfe said. “Unfortunately, this still hasn’t worked, because it is a very slow process, and users resent uploading private documents to these counter-parties in order to use the platform.”</p>



<hr class="wp-block-separator">
<p><strong>Get the day’s top crypto news and insights delivered to your inbox every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.</strong></p>
<hr class="wp-block-separator">


In Latest Crypto Hack, 20M Tokens Lost as Market Maker Wintermute Takes Blame

Garrett Harper


<p>On today&#8217;s episode of &#8220;<a href="https://www.youtube.com/channel/UCEOv-8wHvYC6mzsY2Gm5WcQ" target="_blank" rel="noreferrer noopener">Empire</a>,&#8221; Jason is joined by Byron Gilliam &#8211; markets strategist and author of the Blockworks newsletter. Often called the Matt Levine of Web3, Byron brings his traditional finance experience to crypto with a mix of wisdom and wit.</p>



<p>Jason and Byron cover this week&#8217;s biggest stories and explore crypto&#8217;s outlook as an investable asset class. Episode highlights include:</p>



<ul><li>Why Byron frames crypto as commodities, not equities</li><li>How private markets are losing their advantage</li><li>Why crypto may be amazing for users but a bad investment</li><li>How OpenSea&#8217;s insider trading news will affect other Web3 companies</li><li>What happened with Optimism&#8217;s airdrop</li><li>Can L2s find a sustainable revenue model</li><li>How BTC mining could fuel growth in renewable energy</li><li>Byron questions if MEV is crypto&#8217;s only use case</li><li>Why UST&#8217;s collapse was not crypto&#8217;s Lehman moment</li><li>and much more</li></ul>



<p>Check out what they had to say in the video below.👇</p>



<figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
<iframe loading="lazy" title="Is Crypto an Investable Asset Class? | Weekly Roundup" width="1024" height="576" src="https://www.youtube.com/embed/-Yjdgwjxd7o?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
</div></figure>



<h3><strong>About the show</strong></h3>



<p>&#8220;Empire&#8221; is a twice-a-week show where we share the real crypto stories that aren’t heard elsewhere. On Mondays, Jason and Santiago Santos interview crypto industry movers and shakers to talk about their struggles, bold moves and tough decisions. Finish off the week with Friday&#8217;s weekly roundup episode that covers the top news and narratives of the week.</p>



<p>For any NPR or Guy Raz fans out there, you can think of &#8220;Empire&#8221; as a &#8220;How I Built This&#8221; for the bitcoin and crypto industry.</p>



<p>Subscribe to &#8220;Empire&#8221; today on&nbsp;<a href="https://podcasts.apple.com/us/podcast/empire/id1554930038" target="_blank" rel="noreferrer noopener">Apple</a>&nbsp;or&nbsp;<a href="https://open.spotify.com/show/4UTePv1CR3APdKOiosR3Iq" target="_blank" rel="noreferrer noopener">Spotify</a>. Watch episodes on&nbsp;<a href="https://www.youtube.com/channel/UCEOv-8wHvYC6mzsY2Gm5WcQ" target="_blank" rel="noreferrer noopener">YouTube</a>.</p>



<hr class="wp-block-separator">
<p><strong>Get the day’s top crypto news and insights delivered to your inbox every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.</strong></p>
<hr class="wp-block-separator">


Podcast: Is Crypto an Investable Asset Class? | Roundup

Macauley Peterson

<div id="highlights-block_626c24657504e" class="highlights">
        <ul>
                <li>Governance will eventually be split between two co-equal branches, according to a constitution</li>
                <li>An initial retroactive airdrop will be the first of many seeking to coordinate network participants</li>
            </ul>
    
</div>



<p>Optimism — an Ethereum layer-2 solution featuring optimistic <a href="https://ethereum.org/en/developers/docs/scaling/layer-2-rollups/" target="_blank" rel="noreferrer noopener">rollups</a> — is planning to decentralize its governance through the release of a token.</p>



<p>The network detailed the token launch, OP, in <a href="https://optimism.mirror.xyz/gQWKlrDqHzdKPsB1iUnI-cVN3v0NvsWnazK7ajlt1fI" target="_blank" rel="noreferrer noopener">a blog post</a> this week. While not the first layer-2 to launch a token, the mechanism of distributing it and the overall governance structure is novel in that it envisions a bicameral system of co-equal “houses”: a “Citizens’ House” and a “Token House.”</p>



<p>“If we just had tokens, then governance rights would be buyable on the open market,” Karl Floersch, chief technology officer, said on the <a href="https://youtu.be/bKVIfJIhS1o" target="_blank" rel="noreferrer noopener">Bankless podcast</a>.</p>



<p>The plan calls for an “Optimism Collective,” which explicitly aims to prevent the centralization of governance power in the hands of moneyed interests. “It’s more equal,” Floersch said.</p>



<p>Rather than follow a one-token-one-vote structure, the system’s architects at Optimism PBC, a public-benefit corporation rebranded as <a href="https://www.linkedin.com/company/oplabs-pbc/" target="_blank" rel="noreferrer noopener">OP Labs</a>, sought to create a “balanced, decentralized, bottom-up governance system by the people for the people.”</p>



<figure class="wp-block-image"><img src="https://lh6.googleusercontent.com/zlPgxN-dVJuNTJVGkWd0KXLuHeXpYPIlIETDCPQxX8MX0rqb2H9VQzrgq0weu_noPb8ZKK_-B5J2Hx5m7rFIe2704-wG50po3a5a0xKkAD4o9kMEdQPKCDea0G2clrf-g_K9R1C8agTq6eZK9w" alt=""/><figcaption><em>An illustration of the proposed Optimism governance scheme</em></figcaption></figure>



<p>Layer-2 implementations, built on top of Ethereum’s mainnet, inherit Ethereum’s security but allow transaction throughput to scale, while reducing gas fees — the cost of block space on the network. Optimism is currently the third largest layer-2 by total value locked, at $670 million, behind Arbitrum and dYdX, according to <a href="https://l2beat.com/">L2beat</a>.</p>



<p>Tokens have typically been used to bootstrap liquidity on new protocols, but Optimism received an early boost by being the first layer-2 on which <a href="https://uniswap.org/blog/uniswap-optimism-alpha" target="_blank" rel="noreferrer noopener">Uniswap announced</a> it would deploy its leading dex protocol. Synthetix, another decentralized finance (DeFi) blue chip, <a href="https://blog.synthetix.io/why-optimism/" target="_blank" rel="noreferrer noopener">embraced the network</a> as its rollup solution of choice.</p>



<h3><strong>A new kind of airdrop</strong></h3>



<p>Jinglan Wang, Optimism’s co-founder and CEO, and Ben Jones, formerly the chief scientist, will move to a new Optimism Foundation, which will fund external teams to build out the OP ecosystem.</p>



<p>The OP token is not yet claimable, let alone tradeable on the secondary market, but the team sought to de-emphasize its role.</p>



<blockquote class="wp-block-quote"><p><strong>“The token is missing the point of this thing. This is about building a new system of governance and funding mechanisms for public goods,” Jones said.</strong></p></blockquote>



<p>The problem with Web2 is plutocracy, Wang said. The Optimism team are trying to avoid a “sneaky plutocracy,” enabling Optimism network participants to coordinate without falling prey to the “pressures of centralization.”</p>



<p>To do that, governance power will reside with “citizens” — holders of NFTs that will be distributed by projects built on Optimism. But unlike most NFTs (non-fungible tokens) today, these will be “soul bound,” that is, fixed to a specific address — a single person. They will not be able to be transferred or sold.</p>



<p>While the details remain scant, the team envision a grassroots network, seeding a “web of trust” on-chain that will grow over time. Independent projects will decide which of their community members will best represent their community’s interests in Optimism governance.</p>



<p>The idea has been received favorably among the broader Ethereum community, with co-founder Vitalik Buterin calling it “possibly the biggest attempt at non-token-holder-centric DAO governance so far.”</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">Possibly the biggest attempt at non-token-holder-centric DAO governance so far. Excited to see where this goes.<br><br>👀 <a href="https://t.co/9vreC7QsXa">https://t.co/9vreC7QsXa</a></p>&mdash; vitalik.eth (@VitalikButerin) <a href="https://twitter.com/VitalikButerin/status/1519012381581463552?ref_src=twsrc%5Etfw">April 26, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>The initial airdrop was aimed to be “super fair,” with a wide distribution and built-in <a href="https://en.wikipedia.org/wiki/Sybil_attack" target="_blank" rel="noreferrer noopener">Sybil-resistance</a>, by rewarding a set of behaviors that would be difficult to game. But it will only be the first of a string of airdrops used to incentivize activity that helps Optimism, and Ethereum more broadly, grow, by distributing public goods funding to recipients from across Ethereum development.</p>



<p>The team see its governance experiment as a test bed for the future evolution of the entire internet.</p>



<blockquote class="wp-block-quote"><p><strong>“Right now we sit at an inflection point…this is a moment where the internet is most sorely in need of human representation, identity, and fixing these problems that we have,” Floersch said.</strong></p></blockquote>



<p>“Humanity is important, we need to capture and fight for our rights as people and individuals to make sure our networks reflect our values.”</p>



<hr class="wp-block-separator">
<p><strong>Get the day’s top crypto news and insights delivered to your inbox every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.</strong></p>
<hr class="wp-block-separator">


Blazing an Optimistic Trail on Ethereum


<p>On today&#8217;s episode of &#8220;<a href="https://www.youtube.com/channel/UCEOv-8wHvYC6mzsY2Gm5WcQ" target="_blank" rel="noreferrer noopener">Empire</a>,&#8221; the long-awaited return of Santi and Jason discussing the latest in crypto, DeFi and more has finally landed. They refresh some predictions around ETH for 2022 and discuss Optimism&#8217;s airdrop, the BAYC Instagram hack, Osmosis’s canonical bridge vote, and announcements from funds and initiatives alike. You won’t want to miss this!</p>



<p>Plus, hear more on:</p>



<ul><li>Optimism&#8217;s two-body &#8220;government&#8221;</li><li>L2 token value vs. ETH</li><li>Does every L1 need its own stablecoin?</li><li>BTC as the base trading pair</li><li><span style="color: initial;">And so much more!</span></li></ul>



<p>Check out what they had to say in the video below.👇</p>



<figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
<iframe loading="lazy" title="Optimism&#039;s Airdrop Is The Future of Governance | Weekly Roundup" width="1024" height="576" src="https://www.youtube.com/embed/2TPyHw8b3pA?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
</div></figure>



<h3><strong>About the show</strong></h3>



<p>&#8220;Empire&#8221; is a twice-a-week show where we share the real crypto stories that aren’t heard elsewhere. On Mondays, Jason and Santiago Santos interview crypto industry movers and shakers to talk about their struggles, bold moves and tough decisions. Finish off the week with Friday&#8217;s weekly roundup episode that covers the top news and narratives of the week.</p>



<p>For any NPR or Guy Raz fans out there, you can think of &#8220;Empire&#8221; as a &#8220;How I Built This&#8221; for the bitcoin and crypto industry.</p>



<p>Subscribe to &#8220;Empire&#8221; today on&nbsp;<a href="https://podcasts.apple.com/us/podcast/empire/id1554930038" target="_blank" rel="noreferrer noopener">Apple</a>&nbsp;or&nbsp;<a href="https://open.spotify.com/show/4UTePv1CR3APdKOiosR3Iq" target="_blank" rel="noreferrer noopener">Spotify</a>. Watch episodes on&nbsp;<a href="https://www.youtube.com/channel/UCEOv-8wHvYC6mzsY2Gm5WcQ" target="_blank" rel="noreferrer noopener">YouTube</a>.</p>



<hr class="wp-block-separator">
<p><strong>Get the day’s top crypto news and insights delivered to your inbox every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.</strong></p>
<hr class="wp-block-separator">
