26 ms·

Attacking an Ethereum L2 with Unbridled Optimism

267 points by daegloe 5y ago

vmception 5y ago
Whats the best way to replicate these states on localhost? When using the L1s, it is easy to fork the current state of the network with Brownie and bang at smart contracts for free using fake gas on localhost. Reserving any advantage or unexpected behavior you find for the bug report, or redeploying it on mainnet for the bug bounty paying the gas just that one time But with L2s in the mix, especially Optimism, how would one do the same? Would it be like two instances of Brownie in virtual environments? Kind of like having a cluster of microservices booted up in Vanguard on localhost?
- saurik 5y ago
  Yeah, so to run your own Optimism full node--the "whole stack"--you need 1) a normal Ethereum full node of some kind, 2) an Optimism data-transport-layer service (which scrapes the L1 looking for L2 transactions and provides a web service to access just that data), and then 3) an Optimism l2geth instance (which is an Ethereum node modified to read its transaction batches from the DTL).
  - vmception 5y ago
    Wow. A tutorial on doing that would be great. Speaking of "bug bounties", I use the term liberally as a euphemism for hacking these contracts and taking everything for yourself under the observation that company/community bug bounty systems are broken and undervalued for the value they provide. Although seen as a euphamism now, I think the term is accurate especially when looking at how bounty was used in the American frontier or Wild West. You made $2,000,042 from this without any drama, in a quick timeline even though it was technically outside of the scope of the program! I think many in the hackernews audience would have liked to have known that from the get go. Many people ignoring blockchain would pivot immediately to at least doing smart contract bug bounty research on the side just from knowing that alone, learning the extremely lucrative and marketable skills in the process. If you formatted the article to the bug-bounty timeline to payout format. You should even show some people a material thing that what you bought with it, because many people still don't understand that this is analogous and convertible to money in your bank account especially at these convenient amounts. How much could you have seized with this bug at the time?
    - yeetard 5y ago
      > I use the term liberally as a euphemism for hacking these contracts and taking everything for yourself under the observation that company/community bug bounty systems are broken and undervalued for the value they provide. hmm...
    - saurik 5y ago
      > ...because many people still don't understand that this is analogous and convertible to money in your bank account especially at these convenient amounts... FWIW this project doesn't have its own token (this L2 uses ETH as its currency just like the base layer), so the bug bounty payout is denominated in actual USD.
      - vmception 5y ago
        Whether they paid in ETH priced in USD, or a stablecoin, or a USD wire to your bank account, many people aren't aware that getting paid in this space is that lucrative and that liquid and that simple.
        seibelj 5y ago
        saurik is pretty famous, I would estimate that most serious players in this space know the money is here. What is good about this post and the fact it's on top of HN is that maybe the average HN reader will be curious and help shift the crypto narrative on HN from negativity to at least neutrality.
        vmception 5y ago
        Yeah it would be great and more on brand for this forum to have neutrality The actual communities for most projects and general crypto are obnoxious, and probably what has helped push or keep this community to negativity, i could see it flipping to neutral though, judging by the emails I get there are plenty builders and educated proponents here
        antocv 5y ago
cgb223 5y ago
Page seems to be down. Can’t connect to server
- saurik 5y ago
  (This has hopefully been fixed; the way I added SSL to my website--which I only the night before last--was "ridiculous" and apparently not at all up for the challenge :/. I thankfully had given myself a backup plan--offloading the SSL to nginx--which I was able to switch to quickly, but I should have really pushed my update today with that configuration.)
iskander 5y ago
This is a concerning aspect of Ethereum's strategy to push scaling to layer-2 networks: Ethereum is a heavily audited and tested protocol that runs an extremely decentralized network of diverse clients. L2s can be...an AWS instance running arbitrary buggy code. Much of the confidence in the "base layer" that people using Ethereum currently experience will be significantly undermined if mundane transactions wend in and out of different L2s.
- sschueller 5y ago
  Isn't the whole lightning network for bitcoin also L2?
  - vmception 5y ago
    hm okay, room for nuance, there are at about a dozen L2 technologies in deployment right now, each with multiple competitors using a specific technology.
  - rawtxapp 5y ago
    It's L2, but you can have different types of L2s. With lightning network, you're opening and closing channels with a counterparty using on-chain transactions, so each channel can be tied back to an on-chain transaction. Before someone points out that it would require tons of on-chain transactions to onboard everyone onto it, you can batch thousands of channel open/closes into a single transaction with new protocol upgrades.
    - idiotsecant 5y ago
      That's not even the most fundamental issue with LN though, it's not a fully thought out system. As LN node count increases the routing complexity increases exponentially, which is the classic problem of routing issues on large graphs that literally every networked system has. The internet solves this with some degree of human intervention to tip the scales to particular routes, which is something that the LN inherently can't (and shouldn't) do. There is some amount of optimization that could take place using common graph routing algorithms like OLSR or others but those represent foundational changes to the protocol which historically LN is allergic to for whatever reason and wouldn't entirely solve the problem in any case. Simply put - it can't scale to that kind of throughput for a combination of cultural and technical reasons.
steelstraw 5y ago
At least Optimism is smart enough to offer huge bounties. They awarded him $2,000,042 for this. https://twitter.com/saurik/status/1491821215924690950 https://twitter.com/saurik/status/1491821215924690950
- deleted 5y ago
  [deleted]
superfrogged 5y ago
May I recommend cracking an economics textbook
- X6S1x6Okd1st 5y ago
  To learn that 2M is a good payout for finding a bug?
- AlexCoventry 5y ago
  What's your point?
kristofferR 5y ago
This title is way underselling this. As far as I could gather from a quick googling, this is the largest single bug bounty payout in history.
- runeks 5y ago
  Along with the bounty for this one: https://gerhard-wagner.medium.com/double-spending-bug-in-polygons-plasma-bridge-2e0954ccadf1 https://gerhard-wagner.medium.com/double-spending-bug-in-pol... (also $2M [1]) [1] https://portswigger.net/daily-swig/polygon-pays-out-record-2-million-bug-bounty-reward-for-critical-vulnerability https://portswigger.net/daily-swig/polygon-pays-out-record-2...
  - saurik 5y ago
    Ah, but, you see: this bounty was $2M...+42! (omg; I honestly hadn't noticed this o_O)
    - maurelian 5y ago
      The extra 42 was just my little hack to get our bounty to appear higher on the list. Nice that it ended up seeing a record too though. :)
- deleted 5y ago
  [deleted]
X6S1x6Okd1st 5y ago
Excellent write up! Glad you were well compensated.
Temasik 5y ago
lihorne 5y ago
Hey! Optimism's head of engineering here! We're super greatful to saurik for writing up such a great analysis of what he found. If you want to hear some of our key takeaways as the maintainers of the network, you can check out our disclosure post here [1]. If you're wondering WTF Optimism is... we are building an optimistic rollup on top of ethereum. The basic idea is to de-couple blockchain computation from data availability and allow a new operator to exist called a sequencer which can accept transaction requests and submit the calldata to Ethereum Mainnet, but do the computation on Optimism Mainnet. There is an idea of a fault proof which means you can verify that the computation done on Optimism Mainnet followed the exact rules of the EVM, and you can prove this on Ethereum Mainnet. Our fault proof codebase, cannon, was built by another jailbreak legend (geohot) precisely with the goal of running Ethereum's battle-tested code and minimize the chances of bugs like this. It's some really cool stuff. If you're into compilers, VMs, and blockchains alike, check it out! [2] The protocol is still in active development, it is not done yet, and that's exactly why we set up this bug bounty program. We think bug bounties matter, a lot, and we're proud to now become the record holders of the largest bug bounty payout in history, however we hope to very quickly be beaten by someone else. Developers like saurik, who we've gotten to know recently, are super important for this ecosystem to thrive. Building this stuff is hard, and we want the best hackers in the world to get rich breaking these protocols because if we succeed in this industry, this technology will be the backbone of the world's financial infrastructure — it needs to be secure. Everything we write is also MIT licensed and developed completely in the open. Very happy to answer any questions, I'll check this thread for the rest of the day — AMA :) Also, we are hiring! [3] [1] https://optimismpbc.medium.com/disclosure-fixing-a-critical-bug-in-optimisms-geth-fork-a836ebdf7c94 https://optimismpbc.medium.com/disclosure-fixing-a-critical-... [2] https://github.com/ethereum-optimism/cannon/ https://github.com/ethereum-optimism/cannon/ [3] https://boards.greenhouse.io/optimism https://boards.greenhouse.io/optimism
- Kalium 5y ago
  Your first link is broken.
  - lihorne 5y ago
    Fixed, sorry
deleted 5y ago
[deleted]
artdigital 5y ago
Can someone explain this to me? He states that Optimism doesn’t have a native gas token and native currency, and eth balances are implemented using ERC20 tokens with OVM instead of the native balance mechanism However the exploit is using selfdestruct to transfer and create the remaining balance to the target address, effectively creating new tokens out of thin air. > This means that, when a contract self-destructs, its balance is BOTH given to the beneficiary AND ALSO KEPT. If the contract had 10 ETH, 10 ETH are CREATED from thin bits and handed to the beneficiary. But I thought from this explanation that contracts don’t have a balance because ETH is stored in an ERC20 contract, and is set to 0. How can the contract have balance (10 ETH) to transfer on selfdestruct when optimism doesn’t have a native balance?
- saurik 5y ago
  Would it help if that paragraph had said "10 OETH"'instead of "10 ETH"? (I am going to go change it regardless, as that is probably at least theoretically less confusing; but, like: is that sufficient?)
  - artdigital 5y ago
    But selfdestruct only acts on balance held in the native token, if it's balance in ERC20 it wouldn't transfer it to the target account I still have trouble understanding how this exploit worked
    - yeetard 5y ago
      Isn't that the actual bug? That balances are kept at two places? What actually happens in SetBalance() if rcfg.UsingOVM ==true? So... I guess what it boils down to is 'How does Optimism manage it's state trie'? I'd really enjoy a more in-depth explanation for this.
paxys 5y ago
Wow I haven't heard Jay Freeman's name in the news since the old iPhone jailbreaking days. Glad to see he is still at it.

267 points by daegloe 5y ago

Whats the best way to replicate these states on localhost? When using the L1s, it is easy to fork the current state of the network with Brownie and bang at smart contracts for free using fake gas on localhost. Reserving any advantage or unexpected behavior you find for the bug report, or redeploying it on mainnet for the bug bounty paying the gas just that one time But with L2s in the mix, especially Optimism, how would one do the same? Would it be like two instances of Brownie in virtual environments? Kind of like having a cluster of microservices booted up in Vanguard on localhost?

saurik 5y ago
Yeah, so to run your own Optimism full node--the "whole stack"--you need 1) a normal Ethereum full node of some kind, 2) an Optimism data-transport-layer service (which scrapes the L1 looking for L2 transactions and provides a web service to access just that data), and then 3) an Optimism l2geth instance (which is an Ethereum node modified to read its transaction batches from the DTL).
- vmception 5y ago
  Wow. A tutorial on doing that would be great. Speaking of "bug bounties", I use the term liberally as a euphemism for hacking these contracts and taking everything for yourself under the observation that company/community bug bounty systems are broken and undervalued for the value they provide. Although seen as a euphamism now, I think the term is accurate especially when looking at how bounty was used in the American frontier or Wild West. You made $2,000,042 from this without any drama, in a quick timeline even though it was technically outside of the scope of the program! I think many in the hackernews audience would have liked to have known that from the get go. Many people ignoring blockchain would pivot immediately to at least doing smart contract bug bounty research on the side just from knowing that alone, learning the extremely lucrative and marketable skills in the process. If you formatted the article to the bug-bounty timeline to payout format. You should even show some people a material thing that what you bought with it, because many people still don't understand that this is analogous and convertible to money in your bank account especially at these convenient amounts. How much could you have seized with this bug at the time?
  - yeetard 5y ago
    > I use the term liberally as a euphemism for hacking these contracts and taking everything for yourself under the observation that company/community bug bounty systems are broken and undervalued for the value they provide. hmm...
  - saurik 5y ago
    > ...because many people still don't understand that this is analogous and convertible to money in your bank account especially at these convenient amounts... FWIW this project doesn't have its own token (this L2 uses ETH as its currency just like the base layer), so the bug bounty payout is denominated in actual USD.
    - vmception 5y ago
      Whether they paid in ETH priced in USD, or a stablecoin, or a USD wire to your bank account, many people aren't aware that getting paid in this space is that lucrative and that liquid and that simple.
      - seibelj 5y ago
        saurik is pretty famous, I would estimate that most serious players in this space know the money is here. What is good about this post and the fact it's on top of HN is that maybe the average HN reader will be curious and help shift the crypto narrative on HN from negativity to at least neutrality.
        vmception 5y ago
        Yeah it would be great and more on brand for this forum to have neutrality The actual communities for most projects and general crypto are obnoxious, and probably what has helped push or keep this community to negativity, i could see it flipping to neutral though, judging by the emails I get there are plenty builders and educated proponents here
        antocv 5y ago

cgb223 5y ago

Page seems to be down. Can’t connect to server

saurik 5y ago
(This has hopefully been fixed; the way I added SSL to my website--which I only the night before last--was "ridiculous" and apparently not at all up for the challenge :/. I thankfully had given myself a backup plan--offloading the SSL to nginx--which I was able to switch to quickly, but I should have really pushed my update today with that configuration.)

iskander 5y ago

This is a concerning aspect of Ethereum's strategy to push scaling to layer-2 networks: Ethereum is a heavily audited and tested protocol that runs an extremely decentralized network of diverse clients. L2s can be...an AWS instance running arbitrary buggy code. Much of the confidence in the "base layer" that people using Ethereum currently experience will be significantly undermined if mundane transactions wend in and out of different L2s.

sschueller 5y ago
Isn't the whole lightning network for bitcoin also L2?
- vmception 5y ago
  hm okay, room for nuance, there are at about a dozen L2 technologies in deployment right now, each with multiple competitors using a specific technology.
- rawtxapp 5y ago
  It's L2, but you can have different types of L2s. With lightning network, you're opening and closing channels with a counterparty using on-chain transactions, so each channel can be tied back to an on-chain transaction. Before someone points out that it would require tons of on-chain transactions to onboard everyone onto it, you can batch thousands of channel open/closes into a single transaction with new protocol upgrades.
  - idiotsecant 5y ago
    That's not even the most fundamental issue with LN though, it's not a fully thought out system. As LN node count increases the routing complexity increases exponentially, which is the classic problem of routing issues on large graphs that literally every networked system has. The internet solves this with some degree of human intervention to tip the scales to particular routes, which is something that the LN inherently can't (and shouldn't) do. There is some amount of optimization that could take place using common graph routing algorithms like OLSR or others but those represent foundational changes to the protocol which historically LN is allergic to for whatever reason and wouldn't entirely solve the problem in any case. Simply put - it can't scale to that kind of throughput for a combination of cultural and technical reasons.

steelstraw 5y ago

At least Optimism is smart enough to offer huge bounties. They awarded him $2,000,042 for this. https://twitter.com/saurik/status/1491821215924690950 https://twitter.com/saurik/status/1491821215924690950

deleted 5y ago
[deleted]

superfrogged 5y ago

May I recommend cracking an economics textbook

X6S1x6Okd1st 5y ago
To learn that 2M is a good payout for finding a bug?
AlexCoventry 5y ago
What's your point?

kristofferR 5y ago

This title is way underselling this. As far as I could gather from a quick googling, this is the largest single bug bounty payout in history.

runeks 5y ago
Along with the bounty for this one: https://gerhard-wagner.medium.com/double-spending-bug-in-polygons-plasma-bridge-2e0954ccadf1 https://gerhard-wagner.medium.com/double-spending-bug-in-pol... (also $2M [1]) [1] https://portswigger.net/daily-swig/polygon-pays-out-record-2-million-bug-bounty-reward-for-critical-vulnerability https://portswigger.net/daily-swig/polygon-pays-out-record-2...
- saurik 5y ago
  Ah, but, you see: this bounty was $2M...+42! (omg; I honestly hadn't noticed this o_O)
  - maurelian 5y ago
    The extra 42 was just my little hack to get our bounty to appear higher on the list. Nice that it ended up seeing a record too though. :)
deleted 5y ago
[deleted]

X6S1x6Okd1st 5y ago

Excellent write up! Glad you were well compensated.

Temasik 5y ago

lihorne 5y ago

Hey! Optimism's head of engineering here! We're super greatful to saurik for writing up such a great analysis of what he found. If you want to hear some of our key takeaways as the maintainers of the network, you can check out our disclosure post here [1]. If you're wondering WTF Optimism is... we are building an optimistic rollup on top of ethereum. The basic idea is to de-couple blockchain computation from data availability and allow a new operator to exist called a sequencer which can accept transaction requests and submit the calldata to Ethereum Mainnet, but do the computation on Optimism Mainnet. There is an idea of a fault proof which means you can verify that the computation done on Optimism Mainnet followed the exact rules of the EVM, and you can prove this on Ethereum Mainnet. Our fault proof codebase, cannon, was built by another jailbreak legend (geohot) precisely with the goal of running Ethereum's battle-tested code and minimize the chances of bugs like this. It's some really cool stuff. If you're into compilers, VMs, and blockchains alike, check it out! [2] The protocol is still in active development, it is not done yet, and that's exactly why we set up this bug bounty program. We think bug bounties matter, a lot, and we're proud to now become the record holders of the largest bug bounty payout in history, however we hope to very quickly be beaten by someone else. Developers like saurik, who we've gotten to know recently, are super important for this ecosystem to thrive. Building this stuff is hard, and we want the best hackers in the world to get rich breaking these protocols because if we succeed in this industry, this technology will be the backbone of the world's financial infrastructure — it needs to be secure. Everything we write is also MIT licensed and developed completely in the open. Very happy to answer any questions, I'll check this thread for the rest of the day — AMA :) Also, we are hiring! [3] [1] https://optimismpbc.medium.com/disclosure-fixing-a-critical-bug-in-optimisms-geth-fork-a836ebdf7c94 https://optimismpbc.medium.com/disclosure-fixing-a-critical-... [2] https://github.com/ethereum-optimism/cannon/ https://github.com/ethereum-optimism/cannon/ [3] https://boards.greenhouse.io/optimism https://boards.greenhouse.io/optimism

Kalium 5y ago
Your first link is broken.
- lihorne 5y ago
  Fixed, sorry

deleted 5y ago

[deleted]

artdigital 5y ago

Can someone explain this to me? He states that Optimism doesn’t have a native gas token and native currency, and eth balances are implemented using ERC20 tokens with OVM instead of the native balance mechanism However the exploit is using selfdestruct to transfer and create the remaining balance to the target address, effectively creating new tokens out of thin air. > This means that, when a contract self-destructs, its balance is BOTH given to the beneficiary AND ALSO KEPT. If the contract had 10 ETH, 10 ETH are CREATED from thin bits and handed to the beneficiary. But I thought from this explanation that contracts don’t have a balance because ETH is stored in an ERC20 contract, and is set to 0. How can the contract have balance (10 ETH) to transfer on selfdestruct when optimism doesn’t have a native balance?

saurik 5y ago
Would it help if that paragraph had said "10 OETH"'instead of "10 ETH"? (I am going to go change it regardless, as that is probably at least theoretically less confusing; but, like: is that sufficient?)
- artdigital 5y ago
  But selfdestruct only acts on balance held in the native token, if it's balance in ERC20 it wouldn't transfer it to the target account I still have trouble understanding how this exploit worked
  - yeetard 5y ago
    Isn't that the actual bug? That balances are kept at two places? What actually happens in SetBalance() if rcfg.UsingOVM ==true? So... I guess what it boils down to is 'How does Optimism manage it's state trie'? I'd really enjoy a more in-depth explanation for this.

paxys 5y ago

Wow I haven't heard Jay Freeman's name in the news since the old iPhone jailbreaking days. Glad to see he is still at it.