$11 823 000 USD

AUGUST 2024

GLOBAL

RONIN NETWORK

DESCRIPTION OF EVENTS

"Ronin is an EVM blockchain crafted for developers building games with player-owned economies."

 

"Developed by Sky Mavis, the creator of Axie Infinity, Ronin is a blockchain built specifically for games. By supporting EVM-compatible smart contracts and protocols, Ronin enables developers to create feature-rich, high-performance blockchain projects."

 

"At 09:37:23 AM UTC, the Axie Infinity: Ronin Bridge V2 transferred 3,996 ETH to the MEV Bot, which then transferred 4.00 ETH to bebaverbuild for potential MEV extraction.

 

Following this, at 10:11:47 AM UTC, MEV Frontrunner Yoink swapped 1,998,046 USDC for 796.41 ETH on Uniswap V3, potentially front-running a trade by a MEV bot."

 

"- Previous versions of Ronin Bridge fetched totalWeight from MainchainBridgeManager contract. - The latest upgrade stores totalWeight in the contract's storage under the variable _totalOperatorWeight. - This variable is initialized in the initializeV3() function, but the deployer only called initializeV4 during the upgrade, leaving _totalOperatorWeight uninitialized and defaulting to 0. - Due to this, the attackers (MEV bots) successfully withdrew 2M USDC and 4000 ETH without signature, as it met the minimumVoteWeight condition (which was 0 due to uninitialized)."

 

"For the Axie Infinity community and Ronin Network users, the words "bridge exploit" likely trigger PTSD."

 

"This time the damage was significantly less [than their previous attack on August 6th], but the psychological impact resonates deeply."

 

"Earlier today, we were notified by white-hats about a potential exploit on the Ronin bridge. After verifying the reports, the bridge was paused approximately 40 minutes after the first on-chain action was spotted.

 

The actors withdrew ~4K ETH and 2M USDC, valued at ~$12M, which is the maximum amount of ETH and USDC that can be withdrawn from the bridge for one single transaction withdrawal. The bridge limit serves as a critical safeguard to increase the security of large fund withdrawals, and it effectively prevented further damage in this exploit.

 

Today’s bridge upgrade, after being deployed through the governance process, introduced an issue leading the bridge to misinterpret the required bridge operators vote threshold to withdraw funds.

 

We are working on a solution for the root cause. The bridge update will undergo intensive audits, before being voted on by the bridge operators for deployment.

 

We are currently negotiating with the actors, who appear to be acting as white-hats and have responded in good faith. Regardless of the result of the negotiations, all user funds are safe and any shortfalls will be re-deposited into the bridge when it opens up.

 

A post-mortem will be shared next week where we will through the technical details and our planned measures to prevent similar occurrences in the future.

 

Appreciate all your support and patience."

Ronin is an EVM blockchain for building blockchain based games, such as the popular Axie Infinity. The protocol has a history of falling victim to attacks, including the largest attack in the history of the blockchain. On August 6th, there was another much smaller attack for $12m USD in ETH and USDC. This was due to a variable which was not initialized when the smart contract was upgraded. Luckily, all funds were taken by white hat hackers running automated bots who returned the funds relatively quickly.

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.