3 ms·
Guessing from the available information, Wormhole works by having a pile of ETH in its account, a piles of wETH tokens backed 1-to-1 by the ETH in the account,
by ww520 5y ago
Guessing from the available information, Wormhole works by having a pile of ETH in its account, a piles of wETH tokens backed 1-to-1 by the ETH in the account, and piles of other types of tokens, like Solana.
When the wETH coins are initially set up, there's a way to deposit the initial ETH tokens into the Wormhole's ETH account to jump start the whole process.
When a user wants to convert Solana to ETH, he deposits the Solana tokens to the Wormhole smart contract and it issues the wETH tokens at some exchange rate, taking a 1-1 ETH from Wormhole's ETH account, tying the Solana and the ETH in the wETH tokens. After the dust is settled, the user can convert the wETH tokens to ETH. The Solana tokens held in the wETH tokens are deposited in Wormhole's Solana account, the ETH tokens held in the wETH tokens are released to the user. Everything is good.
The hack was to create a bunch of Solana based wETH tokens out of the thin air, exploiting a bug in teh Wormhole smart contract. The hackers forced a settling of the fake wETH tokens against Wormhole's ETH account, taking the ETH away. In the process, leaving whole bunch garbage Solana tokens in Wormhole's Solana account. Now Wormhole's ETH account is down by $320M. Whatever wETH tokens floating out there have no 1-1 backing from the ETH account. The whole thing can collapse with a bank run.
They fixed it by depositing $320M ETH tokens into the Wormhole's ETH account to ensure the fake wETH tokens are backed as well. The fake Solana tokens are still in their account. It's basically they're using $320M ETH tokens to buy a bunch of Solana tokens, which the hackers created.
So at the end, they're not really out of $320M money; they still have the $320M Solana tokens, fake or not. It's just the general public got screwed by having $320M of Solana tokens inflated on them.