BEDROCK TECHNOLOGY

DESCRIPTION OF EVENTS

"The world's first multi-asset liquid restaking protocol."

"Bedrock is a multiple asset liquid restaking protocol, that backed by non-custodial solution designed in partnership with RockX, a longstanding blockchain infrastructure company with strong roots in crypto staking."

"uniBTC [is a] brand new restaking protocol that accept wrapped BTC tokens partnership with the BTC staking protocol Babylon chain, the first supported wrapped BTC is wBTC token on Ethereum blockchain, so all the wBTC token holders will enjoy both yield on staking BTC tokens plus the security of Ethereum network."

"The uniBTC contracts are designed to enable users to convert their BTC assets into an equivalent amount of uniBTC tokens. By design, minting uniBTC using native tokens on non-native BTC chains should NOT be allowed, as the native token no longer represents native BTC."

A "vulnerable contract was deployed across eight different chains: Ethereum, BNBChain, Arbitrum, Optimism, Mantle, Mode, BOB, and ZetaChain."

"The uniBTC contracts are designed to enable users to convert their BTC assets into an equivalent amount of uniBTC tokens. By design, minting uniBTC using native tokens on non-native BTC chains should NOT be allowed, as the native token no longer represents native BTC."

"The handling of native tokens differs from wrapped tokens because msg.value is already transferred into the contract. As a result, the check on Line 170 does not need to account for the _amount transferred, unlike the check on Line 184. Therefore, if the cap is set to 0, the mint function will revert for native tokens.

The vulnerability lies within the SigmaSupplier (Sigma) contract.

First, tokens must be registered to be included in the current total balance of native or wrapped BTC tokens. Second, if a token is not registered, the contract returns 0, meaning it cannot be found in the tokenHolders variable. The following figure shows that only FBTC, WBTC, and cbBTC have been registered, while NATIVE_BTC has NOT. On one hand, NATIVE_BTC should NOT be registered in this contract, as it is not intended to be supported. On the other hand, failing to register NATIVE_BTC results in the totalSupply always being ZERO, which contradicts the caps restriction mechanism.

Since the total supply at that time was ZERO instead of reflecting the msg.value received by the contract, the check the Vault contract passed, allowing the minting of uniBTC using native tokens on non-native BTC chains.

Therefore, on a non-native BTC chain, replacing the balance with the total supply is acceptable for wrapped BTC tokens but problematic for native tokens."

"In response, we paused the vulnerable contract and implemented a fix to mitigate the vulnerability, which was later confirmed to have affected approximately $2 million in liquidity, primarily within the Uniswap pool."

"The multi-chain liquidity re-staking protocol Bedrock announced on social media that the team is aware of a security vulnerability involving uniBTC, with the total estimated loss from the theft around $2 million. According to the SlowMist security team’s analysis, the attack was caused by Bedrock mistakenly supporting the minting of uniBTC at a 1:1 exchange rate with the native token."

"We want to inform you that the Bedrock team is aware of a security exploit involving uniBTC. The issue has been handled and funds are SAFU.

We want to reassure everyone that the underlying wrapped BTCs and BTCs in reserves are secure. The total estimated impact of the exploit is approximately $2 million (mostly in DEX LPs). The root cause has been identified and we are taking steps to address it. A comprehensive reimbursement plan is being finalized and will be shared shortly together with a post-mortem report.

Bedrock is collaborating closely with audit teams and white hats to recover the lost funds. A Proof of Reserves will be shared once it is available to ensure transparency.

At this time, no extra actions are required from our community. Rest assured that all uniBTC held by users are safe."

"Bedrock is integrating @chainlink Proof of Reserve to enhance security and help prevent future exploits.

As the industry standard, Proof of Reserve will secure our minting function, providing users with cryptographic guarantees around asset reserves."

Rekt - Bedrock - Rekt (Oct 1)
SlowMist Hacked - SlowMist Zone (Oct 1)
@dedaub Twitter (Oct 1)
@Bedrock_DeFi Twitter (Oct 1)
@Bedrock_DeFi Twitter (Oct 1)
Post Mortem Report — Bedrock (Oct 1)
Bedrock: World's first multi-asset liquid restaking protocol (Oct 1)
Introducing Bedrock | Bedrock (Oct 1)
Audit reports | Bedrock (Oct 1)
@Bedrock_DeFi Twitter (Oct 1)
Bedrock Is Integrating Chainlink Proof of Reserve To Natively Se… — Bedrock (Oct 1)
@Bedrock_DeFi Twitter (Oct 1)
x.com (Nov 4)

More case studies

Onyx Protocol Low Liquidity
NFTLiquidation Vulnerability

Fire Token Burn
Mechanism Exploited