Cross-chain bridge users saved by Twitter from exploitation
Recently BitBTC has been attacked by an error that is attacking to mint fake tokens on one end and changing them to real ones on the other. Fortunately, it was spotted by one of the Twitter users and saved the cross-chain between BitBTC and Ethereum layer-2 from bearing a huge loss.
The customer cross-chain ramp offers to deliver assets among Optimism’s and BitAnts’s Defi ecosystem, which consists of non-fungible tokens, yield services, swap, and BitBTC tokens, in which 1 million BitBTC means 1 Bitcoin. The error was brought to light when the tech lead of L2 network Abirtrum, Lee Bousfield Twitted on Oct 18, “BitBTC’s Optimism bridge is trivially vulnerable.”
He also said that “the team ignored my messages, so I’m going to publish the critical exploit here.”
According to Bousfield, the bridge bug would attack the mint fake tokens on one end of the bridge and convert them to real ones on the other.
“The Optimism L2 side of the bridge lets you withdraw any token, and it lets that token pick the L1Token address passed to the L1 side of the bridge. However, the L1 bridge completely ignores what the L2 token was, and just goes ahead and mints the arbitrary L1 token!”
For the error to be oppressed fully, Bousfield highlighted that it would roughly take “ a week to go through, during which L1 bridge will be updated”. Soon after someone went on and try the theory, with an attempt to withdraw “200 million fake BitBTC from Optimism.” Repeatedly the withdrawal was a mere test.
Bousfield noticed a quick update around 10 hours after the error had been bought to the eyes of the people and managed to get in touch with the BitBTC team.
Kevin Fichter, Optimism developer, confirmed that the error was from BitBTC’s end and they used their own customer’s bridge on Oct 18.
He also confirmed that “ Assets other than BitBTC are not at risk.” also adding “time and energy placed into the standard bridge” and encouraged people to use the regular bridge “unless you know what you’re doing.”