Near Protocol Rainbow Bridge First Attack Mitigated - Revision history

Azoundria: Another 30 minutes complete. Research about HAPI protocol.

2023-11-16T18:05:05Z

Another 30 minutes complete. Research about HAPI protocol.

← Older revision		Revision as of 12:05, 16 November 2023
Line 15:		Line 15:

	Statistics on the rainbow bridge are publicly available on the Dune website<ref name="dune-10200">[https://dune.com/zavodil/rainbow-bridge NEAR Rainbow Bridge Statistics - Dune] (Jan 9, 2023)</ref>.		Statistics on the rainbow bridge are publicly available on the Dune website<ref name="dune-10200">[https://dune.com/zavodil/rainbow-bridge NEAR Rainbow Bridge Statistics - Dune] (Jan 9, 2023)</ref>.

			NEAR, a blockchain infrastructure, challenges the centralized cloud space by providing a community-operated, distributed node-powered cloud-computing infrastructure. This approach contrasts with centralized solutions prone to concentrated risks. NEAR's distributed ledger, in the event of a DDoS attack, lacks a central point of attack, enhancing stability<ref name=":0">[https://medium.com/i-am-hapi/near-and-hapi-a22ee7731b9e Near and HAPI - Dona Mara Medium] (Nov 16th, 2023)</ref>.

	== The Reality ==		== The Reality ==
Line 67:		Line 69:
	\|Twitter Post About The Attack		\|Twitter Post About The Attack
	\|Alex Shevchenko posts a summary with details of the unsuccessful attack and that the costs for attacking the protocol will also be increased<ref name="alexauroradevtwitter-10209" />.		\|Alex Shevchenko posts a summary with details of the unsuccessful attack and that the costs for attacking the protocol will also be increased<ref name="alexauroradevtwitter-10209" />.
			\|-
			\|May 2nd, 2022 12:19:00 AM MDT
			\|Inquiry About HAPI Protocol
			\|Twitter user Jake Prior posts to inquire about the role of the HAPI protocol in preventing the attack. This is not answered<ref name=":1">[https://twitter.com/jakeprior88/status/1521011572117852160 jakeprior88 - "Did @i_am_hapi_one $HAPI protocol help In any of this attack ? $HAPI is deployed in the rainbow Bridge right?" - Twitter] (Nov 16, 2023)</ref>.
	\|-		\|-
	\|August 22nd, 2022 6:31:00 AM MDT		\|August 22nd, 2022 6:31:00 AM MDT
	\|~~Referenced in~~ Report of Second Attack		\|Report of Second Attack
	\|The first attack is ~~reverenced~~ in a report on the second attack attempt<ref name="alexauroradevtwitter-10208" />.		\|The first attack is referenced in a report on the second attack attempt<ref name="alexauroradevtwitter-10208" />.
	\|-		\|-
	\|August 23rd, 2022 6:08:00 AM MDT		\|August 23rd, 2022 6:08:00 AM MDT
	\|Referenced In CoinDesk Article		\|Referenced In CoinDesk Article
	\|The first attack is referenced in a CoinDesk article on a second attack attempted on the protocol<ref name="coindesk-10196" />.		\|The first attack is referenced in a CoinDesk article on the second attack attempted on the protocol<ref name="coindesk-10196" />.
	\|}		\|}

Line 83:		Line 89:

	"For at least 6 months we knew that watchdog transaction would be front run by the MEV bots (reported by our auditors @sigp_io). [The m]ain reason to keep this mechani[sm] is the additional protection: MEV bots know how to get transactions executed ASAP."		"For at least 6 months we knew that watchdog transaction would be front run by the MEV bots (reported by our auditors @sigp_io). [The m]ain reason to keep this mechani[sm] is the additional protection: MEV bots know how to get transactions executed ASAP."

			=== Role Of HAPI Protocol ===
			HAPI, a cybersecurity layer, aims to prevent money laundering, hacking, and unauthorized transactions within the HAPI Protocol network. Its on-chain approach, embedding smart contracts, enables immediate notification and alerting, preventing adversarial attacks. The partnership between NEAR and HAPI focuses on expanding NEAR's ecosystem, securing the blockchain, and extending the DeFi space<ref name=":0" />.

			https://twitter.com/haenko21/status/1444303695966056451

			Twitter user Jake Prior posts to inquire about the role of the HAPI protocol in preventing the attack. This is not answered<ref name=":1" />.

			https://twitter.com/MilkyGemHunter/status/1519779420470497280

			https://twitter.com/veshorg/status/1444008053532209153

			https://twitter.com/donamarahp/status/1453009850267578372

			https://twitter.com/i_am_hapi_one/status/1581359568181137409

	== Total Amount Lost ==		== Total Amount Lost ==

Azoundria: Another 30 minutes complete.

2023-06-14T22:13:51Z

Another 30 minutes complete.

Show changes

Azoundria: Completed initial 30 minutes, all sources integrated.

2023-04-17T22:19:58Z

Completed initial 30 minutes, all sources integrated.

Show changes

Azoundria at 16:11, 12 April 2023

2023-04-12T16:11:06Z

← Older revision		Revision as of 10:11, 12 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/nearprotocolrainbowbridgefirstattackmitigated.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/nearprotocolrainbowbridgefirstattackmitigated.php}}
			{{Unattributed Sources}}

	[[File:Nearprotocolrainbowbridge.jpg\|thumb\|Near Protocol]]The Near Protocol Rainbow Bridge allows the transfer of tokens between the Ethereum, Near, and Aurora blockchain networks. Like most bridges, there is a possibility of attackers submitting fraudulent transactions trying to trick the bridge into releasing funds without making an actual payment. The Near Protocol Rainbow Bridge requires the attacker to send a "safe deposit", has watchdogs monitoring the network, and allows validators to flag and reject any suspicious transactions.		[[File:Nearprotocolrainbowbridge.jpg\|thumb\|Near Protocol]]The Near Protocol Rainbow Bridge allows the transfer of tokens between the Ethereum, Near, and Aurora blockchain networks. Like most bridges, there is a possibility of attackers submitting fraudulent transactions trying to trick the bridge into releasing funds without making an actual payment. The Near Protocol Rainbow Bridge requires the attacker to send a "safe deposit", has watchdogs monitoring the network, and allows validators to flag and reject any suspicious transactions.
Line 5:		Line 6:
	On the early morning between April 30th and May 1st (depending on timezone), a fraudulent transaction was submitted. It was successfully detected and mitigated in this case, and no funds were lost.		On the early morning between April 30th and May 1st (depending on timezone), a fraudulent transaction was submitted. It was successfully detected and mitigated in this case, and no funds were lost.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="coindesk-10196" /><ref name="alexauroradevtwitter-10208" /><ref name="alexauroradevtwitter-10209" /><ref name="etherscan-10210" /><ref name="etherscan-10211" /><ref name="etherscan-10212" /><ref name="etherscan-10213" /><ref name="etherscan-10214" /><ref name="etherscan-10215" /><ref name="etherscan-10216" /><ref name="etherscan-10217" /><ref name="auroraisneargithub-10218" /><ref name="neardotorg-10202" /><ref name="neardotorg-10203" /><ref name="neardotorg-10204" /><ref name="etherscan-10205" /><ref name="youtube-10206" /><ref name="101blockchains-10207" />

	== About Near Protocol ==		== About Near Protocol ==
Line 77:		Line 78:
	!Description		!Description
	\|-		\|-
	\|April 30th, 2022 10:07:35 PM		\|April 30th, 2022 10:07:35 PM MDT
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 104:		Line 105:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			This system seems to have worked effectively due to the multi-signature nature of having multiple independent validators to approve the transactions. Such a system likely works well to automatically approve small value transactions, where there is minimal incentive to attack, with continual adaptation and a small treasury to pay out any losses available. Larger transactions would likely benefit from human oversight as it can be challenging to be sure that the automated systems will effectively detect the full diversity of potential fraudulent transactions. There is a tendency for all nodes to employ similar software that will make the exact same decision, thereby negating key benefits of the multi-signature setup.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

	== Prevention Policies ==		== Platform Prevention Policies ==
	This system seems to have worked effectively due to the multi-signature nature of having multiple independent validators to approve the transactions. Such a system likely works well to automatically approve small value transactions, where there is minimal incentive to attack, with continual adaptation and a small treasury to pay out any losses available. Larger transactions would likely benefit from human oversight as it can be challenging to be sure that the automated systems will effectively detect the full diversity of potential fraudulent transactions. There is a tendency for all nodes to employ similar software that will make the exact same decision, thereby negating key benefits of the multi-signature setup.		{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	[https://www.coindesk.com/tech/2022/08/23/hackers-lose-5-ether-while-trying-to-attack-near-protocols-rainbow-bridge/ Hackers Lose 5 Ether While Trying to Attack Near Protocol’s Rainbow Bridge] (Aug 23)		<references><ref name="coindesk-10196">[https://www.coindesk.com/tech/2022/08/23/hackers-lose-5-ether-while-trying-to-attack-near-protocols-rainbow-bridge/ Hackers Lose 5 Ether While Trying to Attack Near Protocol’s Rainbow Bridge] (Aug 23, 2022)</ref>

	[https://twitter.com/AlexAuroraDev/status/1561692648129212418 @AlexAuroraDev Twitter] (Jan 9)		<ref name="alexauroradevtwitter-10208">[https://twitter.com/AlexAuroraDev/status/1561692648129212418 @AlexAuroraDev Twitter] (Jan 9, 2023)</ref>

	[https://twitter.com/AlexAuroraDev/status/1520810591803293696 @AlexAuroraDev Twitter] (Jan 9)		<ref name="alexauroradevtwitter-10209">[https://twitter.com/AlexAuroraDev/status/1520810591803293696 @AlexAuroraDev Twitter] (Jan 9, 2023)</ref>

	[https://etherscan.io/address/0xa4b2aa64b348e4186539e3c3c3f2e80355a5ebc2 Rainbow Bridge Attacker \| Address 0xa4b2aa64b348e4186539e3c3c3f2e80355a5ebc2 \| Etherscan] (Jan 9)		<ref name="etherscan-10210">[https://etherscan.io/address/0xa4b2aa64b348e4186539e3c3c3f2e80355a5ebc2 Rainbow Bridge Attacker \| Address 0xa4b2aa64b348e4186539e3c3c3f2e80355a5ebc2 \| Etherscan] (Jan 9, 2023)</ref>

	[https://etherscan.io/tx/0x290aa447d0cc4d6dba91935cd257c7e436dd910abeee2a91d5f58e1a86ce5f24 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9)		<ref name="etherscan-10211">[https://etherscan.io/tx/0x290aa447d0cc4d6dba91935cd257c7e436dd910abeee2a91d5f58e1a86ce5f24 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9, 2023)</ref>

	[https://etherscan.io/tx/0x342ad0d9acfeed484f61f75971e30a38affdede61d12d17bf413f9aa0d24cc1c Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9)		<ref name="etherscan-10212">[https://etherscan.io/tx/0x342ad0d9acfeed484f61f75971e30a38affdede61d12d17bf413f9aa0d24cc1c Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9, 2023)</ref>

	[https://etherscan.io/tx/0x31978ff63987f452bbec505613d09d83943beaf11d9053f089310dc32fb8da59 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9)		<ref name="etherscan-10213">[https://etherscan.io/tx/0x31978ff63987f452bbec505613d09d83943beaf11d9053f089310dc32fb8da59 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9, 2023)</ref>

	[https://etherscan.io/tx/0xb5b489bad56352742ab3a2b5c4659d2f6487ac79f222c87079e0330af36df91e Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9)		<ref name="etherscan-10214">[https://etherscan.io/tx/0xb5b489bad56352742ab3a2b5c4659d2f6487ac79f222c87079e0330af36df91e Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9, 2023)</ref>

	[https://etherscan.io/tx/0x5edcf538538819c91ed2ffa115f380ccaa2fe71ca264b7b1e199cb5d913b21fc Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9)		<ref name="etherscan-10215">[https://etherscan.io/tx/0x5edcf538538819c91ed2ffa115f380ccaa2fe71ca264b7b1e199cb5d913b21fc Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9, 2023)</ref>

	[https://etherscan.io/tx/0xd775968438da661ca8b19aa651a646d86b0476961196b214846b52d9c4c9eb66 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9)		<ref name="etherscan-10216">[https://etherscan.io/tx/0xd775968438da661ca8b19aa651a646d86b0476961196b214846b52d9c4c9eb66 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9, 2023)</ref>

	[https://etherscan.io/tx/0x020dd82b92738320488a5d76534917a5429b3008dcf8058f113f932a70771637 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9)		<ref name="etherscan-10217">[https://etherscan.io/tx/0x020dd82b92738320488a5d76534917a5429b3008dcf8058f113f932a70771637 Ethereum Transaction Hash (Txhash) Details \| Etherscan] (Jan 9, 2023)</ref>

	[https://github.com/aurora-is-near/rainbow-bridge GitHub - aurora-is-near/rainbow-bridge: ~~��~~ NEAR <> Ethereum Decentralized Bridge] (Jan 9)		<ref name="auroraisneargithub-10218">[https://github.com/aurora-is-near/rainbow-bridge GitHub - aurora-is-near/rainbow-bridge: NEAR <> Ethereum Decentralized Bridge] (Jan 9, 2023)</ref>

	[https://near.org/bridge/ Bridge from Ethereum to NEAR \| The Rainbow Bridge] (Jan 9)		<ref name="neardotorg-10202">[https://near.org/bridge/ Bridge from Ethereum to NEAR \| The Rainbow Bridge] (Jan 9, 2023)</ref>

	[https://near.org/blog/the-rainbow-bridge-is-live/ The Rainbow Bridge Is Live – NEAR Protocol] (Jan 9)		<ref name="neardotorg-10203">[https://near.org/blog/the-rainbow-bridge-is-live/ The Rainbow Bridge Is Live – NEAR Protocol] (Jan 9, 2023)</ref>

	[https://near.org/blog/eth-near-rainbow-bridge/ ETH-NEAR Rainbow Bridge – NEAR Protocol] (Jan 9)		<ref name="neardotorg-10204">[https://near.org/blog/eth-near-rainbow-bridge/ ETH-NEAR Rainbow Bridge – NEAR Protocol] (Jan 9, 2023)</ref>

	[https://etherscan.io/address/0x3be7df8db39996a837041bb8ee0dadf60f767038 NearBridge \| Address 0x3be7df8db39996a837041bb8ee0dadf60f767038 \| Etherscan] (Jan 9)		<ref name="etherscan-10205">[https://etherscan.io/address/0x3be7df8db39996a837041bb8ee0dadf60f767038 NearBridge \| Address 0x3be7df8db39996a837041bb8ee0dadf60f767038 \| Etherscan] (Jan 9, 2023)</ref>

	[https://www.youtube.com/watch?v=zbmnITYLE-M Rainbow Bridge Guide (full version) - YouTube] (Jan 9)		<ref name="youtube-10206">[https://www.youtube.com/watch?v=zbmnITYLE-M Rainbow Bridge Guide (full version) - YouTube] (Jan 9, 2023)</ref>

	[https://101blockchains.com/near-rainbow-bridge/ What is NEAR Rainbow Bridge and How do they work?] (Jan 9)		<ref name="101blockchains-10207">[https://101blockchains.com/near-rainbow-bridge/ What is NEAR Rainbow Bridge and How do they work?] (Jan 9, 2023)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/nearprotocolrainbowbridgefirstattackmitigated.php}} Near ProtocolThe Near Protocol Rainbow Bridge allows the transfer of tokens between the Ethereum, Near, and Aurora blockchain networks. Like most bridges, there is a possibility of attackers submitting fraudulent transactions trying to trick the bridge into releasing funds without making an actual paym..."

2023-01-29T03:37:19Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/nearprotocolrainbowbridgefirstattackmitigated.php}} thumb|Near ProtocolThe Near Protocol Rainbow Bridge allows the transfer of tokens between the Ethereum, Near, and Aurora blockchain networks. Like most bridges, there is a possibility of attackers submitting fraudulent transactions trying to trick the bridge into releasing funds without making an actual paym..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/nearprotocolrainbowbridgefirstattackmitigated.php}}

[[File:Nearprotocolrainbowbridge.jpg|thumb|Near Protocol]]The Near Protocol Rainbow Bridge allows the transfer of tokens between the Ethereum, Near, and Aurora blockchain networks. Like most bridges, there is a possibility of attackers submitting fraudulent transactions trying to trick the bridge into releasing funds without making an actual payment. The Near Protocol Rainbow Bridge requires the attacker to send a "safe deposit", has watchdogs monitoring the network, and allows validators to flag and reject any suspicious transactions.

On the early morning between April 30th and May 1st (depending on timezone), a fraudulent transaction was submitted. It was successfully detected and mitigated in this case, and no funds were lost.

This is a global/international case not involving a specific country.

== About Near Protocol ==
"Innovation across DeFi and NFTs has increased demand on the Ethereum network and sent fees soaring." "Blockchain-based bridges allow users to send and receive tokens between different networks by locking native tokens on either side."

"At NEAR, we do not want Ethereum developers to choose between NEAR and Ethereum and commit to only one. We want them to have the same asset on both blockchains and even have apps that seamlessly communicate across the boundary. So we built a bridge, called Rainbow Bridge, to connect the Ethereum and NEAR blockchains, and we created the lowest possible trust level one can have for an interoperability solution — you only need to trust what it connects, the NEAR and Ethereum blockchains, and you don’t need to trust the bridge itself. There is no authority outside Ethereum miners and NEAR validators."

"The ETH <> NEAR Rainbow Bridge allows users to seamlessly migrate assets to NEAR’s developer-friendly and low-cost platform." "Seamlessly migrate assets to NEAR’s developer-friendly and low-cost platform, without compromising on speed." "The first phase of the ETH ↔ NEAR Rainbow Bridge opens the gates for assets to flow freely between NEAR and Ethereum blockchains while enabling users to bridge any ERC-20 token they wish."

"Ethereum users can easily onboard to NEAR using the ETH Faucet, hosted by Paras, and MetaMask. Simply by logging into MetaMask and proving that their account has a balance higher than 0.05 ETH, anyone can claim a NEAR account and start using the Rainbow Bridge right away."

"Rainbow allows users to send tokens among the Ethereum, Near and Aurora networks and has over $2.3 billion in assets locked on the protocol, data shows." "The following popular tokens with common ERC-20 functionality are interoperable with NEAR, including but not limited to[ s]tablecoins like USDT (Tether), DAI, and TUSD, wrapped assets like WBTC and WETH[, ]DEX tokens like UNI and 1INCH[, l]ending tokens like AAVE and COMP[, and s]ervice company tokens like HT (Huobi) and CRO (Crypto.com)[. ]Users can send these ERC-20 assets directly from MetaMask or other Web3 wallets to NEAR wallets and apps, and vice versa."

"Since the Rainbow Bridge does not require the users to trust anything but the blockchains themselves, we call it trustless." "The ETH ↔ NEAR Rainbow Bridge is a trustless, permissionless protocol for connecting blockchains. The bridge protocol removes the need to trust anyone except the security of the connected chains. Anyone can deploy a new bridge, use an existing bridge, or join the maintenance of an existing bridge without getting approval from anyone else."

"The Rainbow Bridge allows any information that is cryptographically provable on NEAR to be usable in Ethereum contracts and vice versa — including the ability to read the state and schedule calls with callbacks on the other chain. This means a user can vote with their ETH balance in a NEAR DAO without sending a transaction on Ethereum." "The nature of the Rainbow Bridge means its fully decentralized and adaptable to any future protocol changes."

"I personally know about 5 watchdogs that are running 24/7. And no one in the world knows about all of them (a protection from the insiders). You can improve the security by simply running the watchdog script from [GitHub]."

"For at least 6 months we knew that watchdog transaction would be front run by the MEV bots (reported by our auditors @sigp_io). [The m]ain reason to keep this mechani[sm] is the additional protection: MEV bots know how to get transactions executed ASAP."

The attacker "got some ETH from Tornado to start the attack around [4 AM UTC]." "With th[is] money he deployed a contract that meant to deposit some funds to become a valid Rainbow Bridge relayer and send the fabricated light client blocks." "He was trying to hit the moment to front run our relayer, but failed to do it."

"After it, he decided to send the similar transaction with the block timestamp in the future (+5h)[. T]his transaction successfully substituted the previously submitted block." "Probably, the combination of the high Ethereum fees (and a delay of the block relaying) and a desire to check whether watchdogs are operational or not, were stimulating an attacker to break the bridge in that exact moment."

"In a short period one of the bridge watchdogs figured out that the block submitted is not in the NEAR blockchain; created a challenge transaction and sent it to Ethereum." "Immediately, MEV bots detected this transaction and figured out that front-running it would result in 2.5 ETH gain, so they did exactly th[at]."

"As a result, [the] watchdog transaction failed[. The] MEV bot transaction succeeded and rolled back the fabricated block of the attacker. Some min[utes] after this, our relayer submitted a new block[.]" "The attack was mitigated fully automatically, Rainbow Bridge users even didn't saw anything happening, continuing transacting in both directions."

The "[a]ttacker lost 2.5 ETH, which was pa[i]d to the MEV bot because of the successful challenge."

"A bit later we started to investigate the strange behaviour and paused all the connectors. And once figured out the details, unpaused them back."

"We [plan to] redesign a bit the challenge payout mechanics, so the majority of the relayer stake is kept in the contract (so, lost to the attacker too), and some fixed amount payed to the watchdog (or MEV bot)." We also plan to "increase the stake for the relayer manyfold, so similar attempts would cost much more." "Money that attackers would loose will be spent for bug bounties and additional audits." "Every watchdog transaction, that would fail because of the front running will be rewarded with a portion of the attacker stake through the manual process. In case this happens, please send me a message."

"I wish everyone who is innovating in the blockchain to pay enough attention to security and robustness of their products through all the available means: automatic systems, notifications, bug bounties, internal and external audits."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Near Protocol Rainbow Bridge First Attack Mitigated
!Date
!Event
!Description
|-
|April 30th, 2022 10:07:35 PM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
No funds were lost.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
This system seems to have worked effectively due to the multi-signature nature of having multiple independent validators to approve the transactions. Such a system likely works well to automatically approve small value transactions, where there is minimal incentive to attack, with continual adaptation and a small treasury to pay out any losses available. Larger transactions would likely benefit from human oversight as it can be challenging to be sure that the automated systems will effectively detect the full diversity of potential fraudulent transactions. There is a tendency for all nodes to employ similar software that will make the exact same decision, thereby negating key benefits of the multi-signature setup.

== References ==
[https://www.coindesk.com/tech/2022/08/23/hackers-lose-5-ether-while-trying-to-attack-near-protocols-rainbow-bridge/ Hackers Lose 5 Ether While Trying to Attack Near Protocol’s Rainbow Bridge] (Aug 23)

[https://twitter.com/AlexAuroraDev/status/1561692648129212418 @AlexAuroraDev Twitter] (Jan 9)

[https://twitter.com/AlexAuroraDev/status/1520810591803293696 @AlexAuroraDev Twitter] (Jan 9)

[https://etherscan.io/address/0xa4b2aa64b348e4186539e3c3c3f2e80355a5ebc2 Rainbow Bridge Attacker | Address 0xa4b2aa64b348e4186539e3c3c3f2e80355a5ebc2 | Etherscan] (Jan 9)

[https://etherscan.io/tx/0x290aa447d0cc4d6dba91935cd257c7e436dd910abeee2a91d5f58e1a86ce5f24 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Jan 9)

[https://etherscan.io/tx/0x342ad0d9acfeed484f61f75971e30a38affdede61d12d17bf413f9aa0d24cc1c Ethereum Transaction Hash (Txhash) Details | Etherscan] (Jan 9)

[https://etherscan.io/tx/0x31978ff63987f452bbec505613d09d83943beaf11d9053f089310dc32fb8da59 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Jan 9)

[https://etherscan.io/tx/0xb5b489bad56352742ab3a2b5c4659d2f6487ac79f222c87079e0330af36df91e Ethereum Transaction Hash (Txhash) Details | Etherscan] (Jan 9)

[https://etherscan.io/tx/0x5edcf538538819c91ed2ffa115f380ccaa2fe71ca264b7b1e199cb5d913b21fc Ethereum Transaction Hash (Txhash) Details | Etherscan] (Jan 9)

[https://etherscan.io/tx/0xd775968438da661ca8b19aa651a646d86b0476961196b214846b52d9c4c9eb66 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Jan 9)

[https://etherscan.io/tx/0x020dd82b92738320488a5d76534917a5429b3008dcf8058f113f932a70771637 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Jan 9)

[https://github.com/aurora-is-near/rainbow-bridge GitHub - aurora-is-near/rainbow-bridge: �� NEAR <> Ethereum Decentralized Bridge] (Jan 9)

[https://near.org/bridge/ Bridge from Ethereum to NEAR | The Rainbow Bridge] (Jan 9)

[https://near.org/blog/the-rainbow-bridge-is-live/ The Rainbow Bridge Is Live – NEAR Protocol] (Jan 9)

[https://near.org/blog/eth-near-rainbow-bridge/ ETH-NEAR Rainbow Bridge – NEAR Protocol] (Jan 9)

[https://etherscan.io/address/0x3be7df8db39996a837041bb8ee0dadf60f767038 NearBridge | Address 0x3be7df8db39996a837041bb8ee0dadf60f767038 | Etherscan] (Jan 9)

[https://www.youtube.com/watch?v=zbmnITYLE-M Rainbow Bridge Guide (full version) - YouTube] (Jan 9)

[https://101blockchains.com/near-rainbow-bridge/ What is NEAR Rainbow Bridge and How do they work?] (Jan 9)