Why White Hat Hackers Are Vital to the Crypto Ecosystem
Jhis last weekend at ETHDenver, Jay Freeman took the stage to highlight his discovery of a nearly billion-dollar bug in the base code of Optimism, Boba and Metis, which he dubbed “Unbridled Optimism.”
Freeman has a history of software development and hacking, including playing a vital role in developing software to jailbreak iOS. His experience has proven invaluable within the Wild West open source crypto industry. Just two weeks ago, a smart contract vulnerability left the Wormhole Bridge with a $350 million hole to fix — and that wasn’t even the biggest feat in recent history. However, Freeman mentioned that bridge exploits are often found quickly because they are often used and constantly monitored by the teams responsible for maintaining them.
Read more: Jump Trading Protects Wormhole’s $320 Million Operating Loss
During the first week of February, Freeman discovered a critical bug in Optimism’s virtual machine – a bug that the developers might not have been ready to fix so quickly. The bug was rooted in Optimism’s self-destruction function that allows contracts to be destroyed and sends any remaining ether balance to a designated address.
Sounds dangerous, so why do blockchains contain the self-destruction a function? The feature allows obsolete or dangerous contracts to be removed from the chain while returning the Ether balance to the rightful owner.
Unless there is a bug, of course.
optimism self-destruction function sent the ether balance back to the designated address without ever burning the balance in a contract. According to Freeman, “This means that when a contract self-destructs, its balance is BOTH given to the beneficiary AND ALSO KEPT.” If the attackers were able to successfully call the contract, they could create a loop that would double their OETH balance until noticed and fixed by the Optimism developers.
Freeman noted that he wasn’t the first person to find the bug after scanning previous ones. self-destruction appeals to the optimism and follow-up of a wallet to an employee of Etherscan. The employee had found and tested the bug, but apparently didn’t understand the seriousness of the situation and let it be. The vulnerability had grown over time as more funds were transferred to Optimism and other Layer 2 systems copied the code Optimism had put in place. Layers 2 are companion networks connected to but functionally separate from the base layer.
Therefore, Freeman noted, had he not found the bug, a keystroke vulnerability would have allowed an attacker to double their funds whenever the self-destruction function was also called on Boba and Metis.
White hats and DeFi
Even if the Optimism team had noticed and temporarily suspended bridge transactions through the sequencer in a theoretical attack, an attacker could still have wreaked havoc on layer 2 decentralized finance (DeFi). By using fake OETH, any attacker could drain decentralized exchanges and exploit lending platforms with unnecessary collateral. The exploit would likely have caused irreparable damage within the Ethereum ecosystem and Layer 2 users could have seen all of their funds rendered useless, with no assets left at the other end of the bridge. Together, Optimism, Boba, and Metis had approximately $750 million locked in DeFi on the day the vulnerability was reported, almost all of which was at risk.
The need for a friendly confrontation
Decentralized finance continues to be a vulnerable industry with anonymous founders, open source code, and billions of dollars looking to take risks. This massive amount of capital has created an incentive system aligned with teams building quickly and releasing tokens.
Read more: Wonderland (and DeFi) Anonymity Problem
Conversely, prudence and professionalism are much less exciting for traders and investors. The global economy has seen time and time again the effect of relentless risk-taking, even as the market eventually sanctions the shortcuts. There’s no reason to think that this same outcome won’t continue to happen in crypto and decentralized finance, with only the most meticulous protocols coming out alive in the end.
Freeman also considered where the middle ground lies between “code is law” and third-party trust. He pointed out that bug bounties are key to incentivizing good actors to research and find vulnerabilities. By setting the reward for being a good actor on a scale similar to the payout for being a bad actor, this scale suddenly tilts the incentives toward the white cap.
As Freedman put it, this kind of “friendly confrontation” can encourage ecosystem participants to be more open, honest, and even pessimistic about new ideas.
This pessimism is the key. Today, the environment may be too optimistic, causing DeFi investors and users to get excited about protocols that may never work or even be dangerous. This lack of oversight, combined with the nature of open source code, creates the perfect environment for hackers and scammers, a problem much of the crypto industry doesn’t seem willing to admit.
The views and opinions expressed herein are the views and opinions of the author and do not necessarily reflect those of Nasdaq, Inc.