Хакер је спасио Абритрум од грешке која испушта Етхереум у Нитро надоградњи

A white hat hacker has discovered a bug within the latest upgrade for Arbitrum, an Ethereum scaling network, that could have led to the theft of over $530 million. 

Arbitrum builder OffChain Labs earlier this week rewarded the hacker, who operates under the pseudonym 0xriptide, with a bounty of 400 ETH (worth approximately $530,000) for sharing the discovery. 

Arbitrum launched its latest upgrade, Nitro, on August 31, in anticipation of the Ethereum merge, the Ethereum network’s recent and much-anticipated transition from a proof-of-work consensus mechanism to доказ улога.

Immediately following the launch of Arbitrum Nitro, 0xriptide began scouring its code in search of any vulnerabilities, according to a блог пост detailing the discovery.

Ethereum scaling networks like Арбитрум navigate the Ethereum mainnet’s slow speed and costly transaction fees by “rolling up” a large quantity of Ethereum transactions on a separate chain and then relaying them back to the Ethereum mainnet as a single transaction. Doing so increases the speed and affordability of Ethereum transactions substantially, but it can also expose users to vulnerabilities. 

0xriptide discovered that the bridge between the Ethereum mainnet and Arbitrum Nitro contained a flaw that would allow any industrious hacker to replace Arbitrum’s destination address with their own. Essentially, any funds meant to flow from Ethereum into Aribitrum could instead be redirected straight into a hacker’s wallet. 

Per 0xriptide, a hacker could have manipulated the bug to either selectively pick off massive individual deposits and avoid detection, or siphoned off Arbitrum’s entire incoming deposit flow. In the period between Artibrum Nitro’s debut in late August and when 0xriptide notified OffChain Labs of the bug, over 400,000 ETH, or $534 million at writing, moved into Arbitrum from Ethereum, according to data from a Дуне Аналитицс табла. 

0xriptide also noted that within the last three weeks, the largest single deposit to Aribtrum amounted to 168,000 ETH, or $225 million at writing. In that period, however, no hacker exploited the bug, and Arbitrum suffered no attacks. 

So-called cross-chain bridge attacks like the one 0xriptide may have prevented are all-too common in the world of Ethereum scalers. In March, Lazarus Group, a North Korea-affiliated hacking group, stole $622 million worth of ETH by infiltrating an Ethereum бочни ланац bridge used by play-to-earn game Axie Infinity. That same group made away with $100 million in June by targeting another Ethereum sidechain bridge utilized by Harmony Protocol. 

Upon confirmation of the flaw in Arbitrum Nitro, OffChain Labs sent 0xriptide a payment of 400 ETH, or just over $530,000, via web3 bug bounty platform ИммунеФи.

"Thank you to the extremely based Arbitrum team for providing a 400 ETH bounty, and of course for creating an incredible piece of technological innovation with their L2 implementation,” 0xriptide wrote on Monday. 

The hacker may have developed second thoughts about the value of their discovery, however. On Tuesday, they tweeted that, given the hundreds of millions of dollars saved, Arbitrum could have been more generous: