A white hat hacker recently came forward and discovered a bug within the Ethereum roll-up Arbitrum, which could have led to the theft of millions of dollars.
Operating under the pseudonym ‘0xriptide’, the hacker was rewarded a bounty of 400 ETH (worth approximately $530,000) by Arbitrum developer OffChain Labs for his discovery.
Just a few weeks ago, Arbitrum launched its Nitro upgrade in anticipation of the Ethereum Merge. In a blog post posted by 0xriptide, he says that he started going through the code of Arbitrum Nitro for vulnerabilities as soon as it was launched.
0xriptide discovered that the bridge between the Ethereum mainnet and the Arbitrum Nitro contained a flaw that would allow any hacker to replace Arbitrum’s destination address with their own.
This means that a hacker could manipulate the code to redirect the funds which are meant to flow from Ethereum to Arbitrum into his own wallet.
0xriptide writes that this can be done in two ways. A hacker could have manipulated the bug to either selectively pick off massive individual deposits and avoid detection, or siphoned off Arbitrum’s entire incoming deposit flow.
From the time of the Arbitrum Nitro upgrade to when 0xriptide notified OffChain Labs of the bug, over 400,000 ETH, or $534 million at writing, moved into Arbitrum from Ethereum.
Once OffChain Labs confirmed the bug, they sent 0xriptide a bounty reward of payment of 400 ETH, or just over $530,000 via ImmuneFi.
0xriptide wrote, “Thank you to the extremely based Arbitrum team for providing a 400 ETH bounty, and of course for creating an incredible piece of technological innovation with their L2 implementation.”
He later tweeted a day later that, given the hundreds of millions of dollars saved, Arbitrum could have been more generous.
