12 ms·
Prior discussion of this incident (and the $2M bounty) here on Hacker News: https://news.ycombinator.com/item?id=30289240 https://news.ycombinator.com/item?id=
by saurik 5y ago
Prior discussion of this incident (and the $2M bounty) here on Hacker News:
https://news.ycombinator.com/item?id=30289240 https://news.ycombinator.com/item?id=30289240
My (I'm the hacker) article / post-mortem this blog post is referring to:
https://www.saurik.com/optimism.html https://www.saurik.com/optimism.html
At the time of this last getting traction a few days ago, some people were sad that the title of my article and the discussion that resulted focused more on the bug instead of the bounty (which my article gets into near the end as part of some high-level thoughts on ethics), which is maybe why I am suddenly seeing this appear here again this morning (as this news article is instead focussing on the bounty angle)?
FWIW, the $2M bounty--which was actually listed as $2,000,042 (as they wanted it to sort higher on the list at Immenufi, lol)--was potentially (none of us realized this at the time I "won", and I am honestly still not 100% sure of it now, though I haven't yet come across any counter-examples) the largest single bug bounty payout ever (...though, by only $42 ;P).
- gus_massa 5y agoCongratulations. I'm not sure if this was discussed in the previous thread, but does the bug allow the creation of real ETH coins, or it just increase the counter in the Optimism database (or whatever system they are using)?
- saurik 5y agoOptimism is a blockchain quite a bit like Ethereum, so the "database" mental model might be a bit confusing for a frame here (as it isn't like they are some centralized service), but no: this doesn't let you directly create ETH (which would be much much more devastating); it only lets you create something we might call "OETH", which is Optimism-specific. The native currency on Optimism (used to pay gas, like ETH is used on Ethereum) is effectively ETH; but, as it isn't Ethereum, that ETH on Optimism has to actually live on Ethereum: it gets locked into a contract there which acts as a repository/reserve for all of the ETH being used on Optimism. When you deposit ETH in this reserve on Ethereum you get credited the same amount on Optimism in the form of cryptocurrency IOUs (which we might call "OETH"), and you can later withdraw that money back to Ethereum, whereupon the OETH is destroyed and ETH is unlocked from the reserve contract. The bug here (which I go into detail in in my post-mortem, along with another / different description of how these "bridges" work) was in the VM used for the smart contract behaviors on Optimism, which would mean you could arbitrarily replicate OETH (the IOUs for ETH). For avoidance of any doubt: you couldn't use this bug to create an arbitrary amount of ETH/Ether, but the issue is that a lot of people call the money on Optimism--which is normally backed 1:1 with ETH--"ETH". (There is a discussion about what it should be called in the Ethereum chains database; I personally think what we need is a terminology for describing the full path whenever you have "ETH via an indirect path".)
- ro-_-b 5y agoThat's very interesting! Thanks for explaining! Let's assume some people would have wanted to bridge OETH back to Ethereum: with the potentially increased supply would it have meant that all the ETH on optimism could have become potentially worthless?
- SilasX 5y agoBut you could drain out all the ETH in the Optimism reserve by asking to withdraw, since you've fooled the network into thinking you own an arbitrary amount of OETH? Which would keep working until the main L1 Eth network rejects transactions for transferring ETH it doesn't have?
- londons_explore 5y agoOr until someone notices... All the balances and stuff are public on the blockchain. It only takes one person to write a script to verify that the locked up amount matches the number of tokens out there. and when it doesn't, alert. That then means any attacker will have to be very quick with their theft, and if so, there is still a good chance whatever coins they get will end up blacklisted or the transactions reversed by a sufficiently large army of upset users who fork the eth network or the L2 network.
- pshc 5y agoThe folks at Optimism would certainly hit the pause button on that withdrawal before it escaped, if there aren't already limits and automatic controls in place. It takes 7 days to withdraw L2->L1 via the standard bridge. (They have administrative controls for now during development, at some point they're supposed to turn it completely permissionless...)
- worldmerge 5y agoCongratulations! Also, thank you for Cydia, I used it in middle school and high school. It definitely made an impression, thank you. Orchid looks cool too!
- secondaryacct 5y agoBut you should have sat on it, laundered it through FBI honeypots and then made a rap album about it !! What have you done telling them about it :D
- aaaaaaaaata 5y agoIs this the reference? https://www.youtube.com/watch?v=SSHrpYeyYV8 https://www.youtube.com/watch?v=SSHrpYeyYV8
- xwolfi 5y agoNo this is: https://www.youtube.com/watch?v=7jlSHGAem6g https://www.youtube.com/watch?v=7jlSHGAem6g !!
- gfd 5y agoPretty sure this is referencing the $3.6B hack https://news.ycombinator.com/item?id=30260787 https://news.ycombinator.com/item?id=30260787 where the wife is a rapper. Though it's pretty weird that I wasn't sure whether you were referencing geohot's (another infamous hacker, mentioned in the article) rap songs at first: https://soundcloud.com/tomcr00se https://soundcloud.com/tomcr00se Not sure why it's a thing for prominent hackers to have aspirations to become soundcloud rappers.
- xwolfi 5y agoyeah so weird, indeed I was referencing the infamous crocodile of Wall St, I had no idea about the other one... Indeed, strange trend :D
- ndugu 5y agoCongrats on the bug bounty, but even greater congrats on Orchid! Hope you continue to change the face of technology and privacy!
- saagarjha 5y agoI’m glad you seem to be happy with your payout, but can we talk for a moment about how much you got? For an exploit like this, especially given how much effort was put into it and how much the market rate of a security engineer like this would be, plus given how much this could be worth on the exploit market, $2 million is literally pennies. This could’ve easily been a bug worth hundreds of millions of dollars. I guess Optimism is lucky that people like you are willing to do “the right thing” even if you’re not being compensated fairly for it, but exploits like these are going to keep happening (and we’ve seen a bunch in this space already) unless bounties go up to match their true value.
- deleted 5y ago[deleted]
- aaaaaaaaata 5y agoMorals aside, which seems to be popular in sec communities, Do you not understand the immense amount of effort they would have needed to expend to hide, not to mention the ongoing stress involved afterward?
- saagarjha 5y agoSurely someone with the skills to find bugs like these would be an expert in cashing out on those bugs?
- revax 5y agoThose skills are unrelated.
- saurik 5y agoYeah... and as the person in question who found and exploited this particular bug ;P, I can definitely state that I would not feel comfortable betting the rest of my life on my ability to safely launder a giant pile of crypto back through to fiat (and then, further, keep that secret for the rest of my life, which shouldn't be downplayed). I am much happier being able to get a bunch of clean money and then be able to give talks on the subject at conferences and get a lot of "street cred" in the tech community for my effort than spending the rest of my life wondering if there's someone from a real-world mob out there trying to hunt me down to recover the $100M I "owe them".
- mhitza 5y agoYour postmortem page throws a "Error code: SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM" in Firefox under Fedora.
- saurik 5y agoHah! When I added SSL to my site a few days ago, I really cranked those settings hard trying to optimize for "security" on the Qualy's SSL Server Test. Do you know what the most secure cipher suite you actually support is (and are you sure the issue isn't that you aren't merely using a particularly-out-of-date copy of Firefox)?
- einichi 5y agoIf his browser doesn't support any of the ciphers you have enabled, that's a problem with his version of Firefox and/or his default TLS library. These ciphers have been around for years and are supported by even some pretty old browsers. Your TLS config is good for now, unless another padding oracle attack comes along and makes those CBC ciphers weak again, or some other vuln. (your cert is expiring next month btw, might be a good opportunity to set up LetsEncrypt)
- mhitza 5y agoSeems to be because of Fedora hardened policy and your site might be supporting SHA1 for use in signatures. One of the three changes with the default tweaks policy that probably makes sense https://fedoraproject.org/wiki/Changes/StrongCryptoSettings2#Detailed_Description https://fedoraproject.org/wiki/Changes/StrongCryptoSettings2... When I set the crypto policy in Fedora to Legacy, which lifts those restrictions, I can visit your website. Chrome doesn't have this problem in Fedora because it ships with its own SSL/TLS specific things bundled (or something along the lines, didn't care to get deeper in the topic).
- saurik 5y agoInteresting! I had went out of my way to add support for TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384--because I consider older versions of Safari critical for my audience--but the way I did that dragged in TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA; I've gone ahead and filtered out SHA1 (so maybe / hopefully this will help).
- shawnk 5y ago
- bla3 5y agoCool hack and writeup!
- sillysaurusx 5y agoSo how many lambos are you buying? More seriously, will you keep it in the bank and extract $100k a year the rest of your life? What are you going to do?
- saurik 5y agoI do not expect to make any major expensive lifestyle changes as a result of having more money (and to the extent to which I have already been being paid better recently due to working on Orchid, I have only barely done so and usually only quite temporarily), which I realize disappoints some people who had wanted me to post a concrete picture of something expensive I purchase to help motivate others to reach for bug bounties ;P. (FWIW, I maybe should at some point buy a car--as I currently waste money on renting one; pre-pandemic I was using a combination of ZipCar and Lyft, but both services suck now--but I can't imagine myself buying a pointlessly extravagant car; and, sadly, now is a bad time to buy a car anyway... which I think is related to the ZipCar issue: I imagine they might have sold their fleet? Maybe ZipCar will return in force when prices rebalance.)
- csdvrx 5y ago> I can't imagine myself buying a pointlessly extravagant car; and, sadly, now is a bad time to buy a car anyway Get a fun car that can be a hacking project :) I was suggested a police car by a friend. They are cheap at auctions, more or less well maintained (tax payer money) and have interesting internals (check sites like https://www.dippy.org/upgrade/dipcop.html https://www.dippy.org/upgrade/dipcop.html) especially for electrical circuits where a police-taxi-module lets you hook up to other functions. And the laptop mount is a geek dream: your laptop right by you, charging, which doubles as a make-do coffee table at the drive through :)
- jimmaswell 5y agoI want to convert an 80s-style car to powerful electric someday, cyberpunk style. Z31 300ZX probably. If I had a lot of money like that I'd build a big garage and do things like that.
- MarcoZavala 5y ago
- rschachte 5y agoReally cool to see Saurik posting here casually. You’re work on Cydia when I was 12 years old is what got me into programming in the first place. Nice work!
- Aulig 5y agoWow, really cool to see this. I remember your name from seeing it in Cydia all the time when I was 11 and had my iPod 2 haha. Congrats on the bounty, glad to see you don't plan on blowing through it mindlessly :) With a worldwide diversified ETF portfolio you should be able to live off of this amount of money indefinitely.
- kristofferR 5y agoYou misspelled Immunefi btw, I went looking for it, but googling "Immenufi" only lead back to your comment. Immunefi turns out to be the correct spelling (weird that Google didn't figure that one out).
- saurik 5y agohttps://immunefi.com/ https://immunefi.com/
- kristofferR 5y agoThanks, I found it, but wanted you to correct it for others. I forgot about the 2h edit limit though.
- djangelic 5y agoThank you for Cydia!! Like another commenter here, it also made a big impression on me!
- cosmosgenius 5y agoIt's so nice to hear from you. Hope you are doing well.
- saurik 5y agoSo, while I knew that this had been offered in back channels, I failed to realize that this was not only confirmed to me in e-mail as well as publicly announced: Boba (one of the forks of Optimism that was affected by this same bug) has additionally extended to me their maximum bug bounty reward of $100k, making the "updated total" awarded for this bug (so far ;P) $2,100,042 (which more firmly might be setting a new record). https://twitter.com/bobanetwork/status/1491989915336388618?s=21 https://twitter.com/bobanetwork/status/1491989915336388618?s...
- deleted 5y ago[deleted]
- antishatter 5y agoNot to be “that guy” but make sure you get an accountant to help you avoid like a $1m tax liability to the extent it is possible. Probably a lot you can do.
- sillysaurusx 5y agoWhich tax liability? That’s news to me.
- anchpop 5y agoAny income is subject to taxes in the US
- sillysaurusx 5y agoYeah, but 50%?
- antishatter 5y agoYeah a prize like this will be close to 50%. If you’re w2 remember that your employer covers like 25% of your tax burden. So when you self employee or win an award like this you end up paying that tax plus the tax your more used to.
- jbirer 5y agoWhy not just hack and watch the world burn?
- sprite 5y agoCongrats. Love your work and glad you got a proper bounty!
- mocmoc 5y agoSaurik you are a true legend
- sersi 5y agoCongratulations! Couldn't happen to a better person. Thanks a lot for Cydia!
- baby 5y agoThat’s what I thought too, but it looks like someone got a bit more than you a few weeks before: https://medium.com/immunefi/polygon-lack-of-balance-check-bugfix-postmortem-2-2m-bounty-64ec66c24c7d https://medium.com/immunefi/polygon-lack-of-balance-check-bu... (Dec 28 2021) > Polygon is paying out a bounty of $2.2m in stablecoins to Leon Spacewalker and 500,000 MATIC to Whitehat2, which according to current market value is worth $1,262,711. The $2.2m exceeds the maximum value of Polygon’s critical bounty in recognition of the severity of the vulnerability. More info about the bug: https://medium.com/immunefi/polygon-lack-of-balance-check-bugfix-postmortem-2-2m-bounty-64ec66c24c7d https://medium.com/immunefi/polygon-lack-of-balance-check-bu... Interestingly, this reminds me of a report I wrote a long time ago about the dangers of ecrecover (as it can give ambiguous results)
- saurik 5y agoOoof... so close!!
- daqhris 5y agoDude that is karma points accumulated throughout your life. Proud that you won! I may have used and enjoyed for FREE some of your software while jailbreaking or bricking mobile devices in my university dorm room (Beijing, 2014). Stay blessed!
- vdalal 5y agoWow, what a find. And save. Very well deserved reward too. Wondering (some of it aloud), how long was the vulnerability present in the code? Is it possible to know if someone was actually using this exploit to mint OETH's? How would a disconnect of this sort show up? Regular reconciliation (hourly, daily) or perhaps there are other methods.
- saurik 5y agoIt existed since November. It is not only possible but I did such a search (and found one such transaction, from a developer at Etherscan, who had seemingly noticed something awkward but not realized it was broken). Search my post-morten for "etherscan" and it should come up!
- SEJeff 5y ago$10m for wormhole and another dao project (if you succeed obviously): https://immunefi.com/bounty/wormhole/ https://immunefi.com/bounty/wormhole/ Good job btw.