Optimism Self Destruct Exploit - Revision history

Azoundria: Another 30 minutes complete. Integrated Reddit discussions. More review of prevention, sources, rest of article.

2024-01-17T17:16:48Z

Another 30 minutes complete. Integrated Reddit discussions. More review of prevention, sources, rest of article.

← Older revision		Revision as of 11:16, 17 January 2024
Line 1:		Line 1:
	{{Case Study Under Construction}}{{Unattributed Sources}}		{{Case Study Under Construction}}{{Unattributed Sources}}

	[[File:Optimism.jpg\|thumb\|Optimism]]Optimism is a layer 2 scaling solution on Ethereum. A critical bug existed in the protocol which would have allowed an attacker to mint additional unbacked Ethereum. The bug was only exploited once, apparently by accident with no loss of funds. On February 2nd, 2022, a white hacker named Jay Freeman found and reported it. The issue was fixed, and he received bounties that totaled $2.1m.		[[File:Optimism.jpg\|thumb\|Optimism Homepage/Logo]]Optimism is a layer 2 scaling solution on Ethereum. A critical bug existed in the protocol which would have allowed an attacker to mint additional unbacked Ethereum. The bug was only exploited once, apparently by accident with no loss of funds. On February 2nd, 2022, a white hacker named Jay Freeman found and reported it. The issue was fixed, and he received bounties that totaled $2.1m.

	~~This is a global/international case not involving a specific country.~~		<ref name="sauriktwitter-6825" /><ref name="bobanetworktwitter-6826" /><ref name="optimismpbctwitter-6827" /><ref name="optimism-6828" /><ref name="optimismcommunity-6829" /><ref name="optimism-6830" /><ref name="saurik-6831" /><ref name="optimistic-6832" /><ref name="cryptoslate-6833" /><ref name="techtimes-6834" /><ref name="bitcoininsider-6835" />
	<ref name="sauriktwitter-6825" /><ref name="bobanetworktwitter-6826" /><ref name="optimismpbctwitter-6827" /><ref name="optimism-6828" /><ref name="optimismcommunity-6829" /><ref name="optimism-6830" /><ref name="saurik-6831" /><ref name="optimistic-6832" /><ref name="cryptoslate-6833" /><ref name="techtimes-6834" /><ref name="bitcoininsider-6835~~" /><ref name="immunefi-6836" /><ref name="optimismgateway-7805~~" />

	== About Optimism ==		== About Optimism ==
Line 21:		Line 20:
	"Until the project is fully decentralized, we will be donating all profits from running a centralized sequencer towards scaling and sustaining public goods."		"Until the project is fully decentralized, we will be donating all profits from running a centralized sequencer towards scaling and sustaining public goods."

			a hacker identified an infinite Ether bug in the Optimism scaling solution for Ethereum but chose not to exploit it. Instead, the hacker, Jay Freeman, reported the bug to Optimism's development team, who awarded him a $2 million bug bounty. Freeman, known for his work on Cydia, discovered the glitch while investigating nano payment protocols. The bug allowed for the creation of unlimited "layer 2" crypto tokens on Optimism, which could have disrupted decentralized exchanges and devalued other tokens. The bug had similarities to the overflow bug in Bitcoin's code in 2010, which resulted in the creation of 184 billion BTC. Another party had previously encountered the bug on Ethereum blockchain explorer Etherscan but may not have realized its potential. Freeman emphasized the importance of prioritizing security and decentralization in blockchain projects<ref name="protos-6823" />.

	a hacker identified an infinite Ether bug in the Optimism scaling solution for Ethereum but chose not to exploit it. Instead, the hacker, Jay Freeman, reported the bug to Optimism's development team, who awarded him a $2 million bug bounty. Freeman, known for his work on Cydia, discovered the glitch while investigating nano payment protocols. The bug allowed for the creation of unlimited "~~layer 2~~" crypto tokens on Optimism, which could have disrupted decentralized exchanges and devalued other tokens. The bug had similarities to the overflow bug in Bitcoin's code in 2010, which resulted in the creation of 184 billion BTC. Another party had previously encountered the bug on Ethereum blockchain explorer Etherscan but may not have realized its potential. Freeman emphasized the importance of prioritizing security and decentralization in blockchain projects<ref name="~~protos~~-~~6823~~" />.		Homepage:<ref name="optimismgateway-7805" />

			Bug Bounty Program:<ref name="immunefi-6836" />

	== The Reality ==		== The Reality ==
Line 44:		Line 46:
	\|-		\|-
	\|February 2nd, 2022		\|February 2nd, 2022
	\|~~Main Event~~		\|Exploit Discovery
	\|~~Expand this into a brief description of what happened and~~ the ~~impact. If multiple lines are necessary, add them here~~.		\|The reported date when the exploit was discovered.
	\|-		\|-
	\|February 10th, 2022 7:54:31 PM MST		\|February 10th, 2022 7:54:31 PM MST
Line 57:		Line 59:
	\|February 14th, 2022 3:19:35 AM MST		\|February 14th, 2022 3:19:35 AM MST
	\|Protos Article Published		\|Protos Article Published
	\|Protos reports that a hacker identified an infinite Ether bug in the Optimism scaling solution for Ethereum but chose not to exploit it. Instead, the hacker, Jay Freeman, reported the bug to Optimism's development team, who awarded him a $2 million bug bounty. Freeman, known for his work on Cydia, discovered the glitch while investigating nano payment protocols. The bug allowed for the creation of unlimited "layer 2" crypto tokens on Optimism, which could have disrupted decentralized exchanges and devalued other tokens. The bug had similarities to the overflow bug in Bitcoin's code in 2010, which resulted in the creation of 184 billion BTC. Another party had previously encountered the bug on Ethereum blockchain explorer Etherscan but may not have realized its potential. Freeman emphasized the importance of prioritizing security and decentralization in blockchain projects<ref name="protos-6823" />.		\|Protos reports that a hacker identified an infinite Ether bug in the Optimism scaling solution for Ethereum but chose not to exploit it<ref name="protos-6823" />. Instead, the hacker, Jay Freeman, reported the bug to Optimism's development team, who awarded him a $2 million bug bounty. Freeman, known for his work on Cydia, discovered the glitch while investigating nano payment protocols. The bug allowed for the creation of unlimited "layer 2" crypto tokens on Optimism, which could have disrupted decentralized exchanges and devalued other tokens. The bug had similarities to the overflow bug in Bitcoin's code in 2010, which resulted in the creation of 184 billion BTC. Another party had previously encountered the bug on Ethereum blockchain explorer Etherscan but may not have realized its potential. Freeman emphasized the importance of prioritizing security and decentralization in blockchain projects<ref name="protos-6823" />.
			\|-
			\|February 14th, 2022 4:40:59 AM MST
			\|Misleading Reddit Title Discussion
			\|A Reddit thread is posted with a misleading title, which many readers incorrectly interpret to mean that there was a layer 1 vulnerability allowing unlimited Ethereum to be created on the Ethereum protocol<ref name=":0">[https://old.reddit.com/r/CryptoCurrency/comments/ss8ohv/hacker_couldve_printed_unlimited_ether_but_chose/ Hacker could’ve printed unlimited ‘Ether’ but chose $2M bug bounty instead - Reddit] (Mar 7, 2023)</ref>. The comments discuss a software engineer named Jay Freeman, also known as the creator of Cydia on jailbroken iOS devices. Freeman discovered a bug in Optimism's code that could have allowed the creation of unlimited Ether. Instead of exploiting it, he reported the issue to Optimism's development team, who rewarded him with a $2 million bug bounty. The post highlights Freeman's significance in the past, particularly in the realm of iOS jailbreaking. Redditors reminisce about the early days of jailbreaking and discuss various related topics, such as Cydia, iPod Touch, and a green helicopter game. Overall, the community expresses appreciation for Freeman's contributions and ethical behavior<ref name=":0">[https://old.reddit.com/r/CryptoCurrency/comments/ss8ohv/hacker_couldve_printed_unlimited_ether_but_chose/ Hacker could’ve printed unlimited ‘Ether’ but chose $2M bug bounty instead - Reddit] (Mar 7, 2023)</ref>.
			\|-
			\|February 14th, 2022 6:10:48 PM MST
			\|Correction Reddit Thread Posted
			\|A Reddit thread discusses the misleading post about a potential hack involving the printing of unlimited Ether<ref>[https://old.reddit.com/r/CryptoCurrency/comments/ssqg25/no_a_hacker_couldnt_have_printed_unlimited_ether/ No, a Hacker couldn't have printed unlimited Ether - Reddit] (Jan 16, 2024)</ref>. The original post highlights a bug found on the second layer, known as "Optimism," not the main layer of Ethereum. The bug could allow unlimited Ether on the second layer, but once users attempt to convert it back to the main layer, the locked ETH would be drained. The thread emphasizes the importance of reading articles to avoid misinformation and provides insights into the challenges faced by the crypto community, including the tendency to rely on headlines rather than delving into the details. Some users also express humor and frustration with the community's reading habits and lack of attention to context.
	\|}		\|}

Line 70:		Line 80:

	"This makes this bug capable of economic griefing attacks, wherein once someone notices—even if it is a mere hour later!—it might be "too late" to unravel what is and what isn't a legitimate transaction, calling into question the entire ledger."		"This makes this bug capable of economic griefing attacks, wherein once someone notices—even if it is a mere hour later!—it might be "too late" to unravel what is and what isn't a legitimate transaction, calling into question the entire ledger."



Line 91:		Line 102:

	"As SELFDESTRUCT is already a rare opcode, and this is even then a subset of all uses of SELFDESTRUCT—and further, as OVM 2.0 was only released three months ago—there was only a single user who had ever tried this: on Christmas Eve (2021)."		"As SELFDESTRUCT is already a rare opcode, and this is even then a subset of all uses of SELFDESTRUCT—and further, as OVM 2.0 was only released three months ago—there was only a single user who had ever tried this: on Christmas Eve (2021)."



Line 103:		Line 115:

	== Immediate Reactions ==		== Immediate Reactions ==



Line 124:		Line 137:

	"As SELFDESTRUCT is already a rare opcode, and this is even then a subset of all uses of SELFDESTRUCT—and further, as OVM 2.0 was only released three months ago—there was only a single user who had ever tried this: on Christmas Eve (2021)."		"As SELFDESTRUCT is already a rare opcode, and this is even then a subset of all uses of SELFDESTRUCT—and further, as OVM 2.0 was only released three months ago—there was only a single user who had ever tried this: on Christmas Eve (2021)."



Line 131:		Line 145:

	"I actually managed to track down this user (!!) and it turns out they work for Etherscan ;P. It just goes to show that sometimes even people who are staring directly at a bug don't always see the indirect security implications."		"I actually managed to track down this user (!!) and it turns out they work for Etherscan ;P. It just goes to show that sometimes even people who are staring directly at a bug don't always see the indirect security implications."


			<ref>[https://old.reddit.com/r/CryptoCurrency/comments/ssqg25/no_a_hacker_couldnt_have_printed_unlimited_ether/hwzecnh/ greenappletree - "Couldn’t they had at least convert all the wETH until the liquidity pool is dried out?" - Reddit] (Jan 16, 2024)</ref><ref>[https://old.reddit.com/r/CryptoCurrency/comments/ssqg25/no_a_hacker_couldnt_have_printed_unlimited_ether/hx0anni/ JJslo - "I guess it will take a Billion in one shot for people to care about security again." - Reddit] (Jan 16, 2024)</ref><blockquote>Couldn’t they had at least convert all the wETH until the liquidity pool is dried out?


			Yes, and when 30kETH gets stolen like this every week (seems to be the trend) it becomes bigger problem. The more L2 solutions, the more opportunities there are. And the hype people make about faster, cheaper L2s just creates more and more VCs found their own L2.

			I guess it will take a Billion in one shot for people to care about security again.</blockquote>

	== Ultimate Outcome ==		== Ultimate Outcome ==



Line 146:		Line 169:

	"I'd missed the confirmation of this on Thursday, but @bobanetwork had decided to additionally extend to me their (maximum) $100k bug bounty payout, making the total reward for my Ethereum L2 bug--"Unbridled Optimism"--$2,100,042! (...I think this might actually set a new record?)"		"I'd missed the confirmation of this on Thursday, but @bobanetwork had decided to additionally extend to me their (maximum) $100k bug bounty payout, making the total reward for my Ethereum L2 bug--"Unbridled Optimism"--$2,100,042! (...I think this might actually set a new record?)"



Line 151:		Line 175:

	"Last week we patched a critical bug in the Optimism codebase, discovered by @saurik." "We’re incredibly thankful to saurik for spending so much time analyzing our protocol over the year--enough to find such an important fix! We highly recommend you check out his in-depth breakdown. We'll award the full $2,000,042 promised in our bug bounty."		"Last week we patched a critical bug in the Optimism codebase, discovered by @saurik." "We’re incredibly thankful to saurik for spending so much time analyzing our protocol over the year--enough to find such an important fix! We highly recommend you check out his in-depth breakdown. We'll award the full $2,000,042 promised in our bug bounty."


	"Optimism did a superb job fixing the vulnerability and working with all ORs and Infra providers to roll out a patch across the OR ecosystem within hours. Your funds are safe and Boba was patched within three hours of the vulnerability being reported."		"Optimism did a superb job fixing the vulnerability and working with all ORs and Infra providers to roll out a patch across the OR ecosystem within hours. Your funds are safe and Boba was patched within three hours of the vulnerability being reported."

Azoundria: Another 30 minutes complete. Prevention added.

2023-07-14T21:08:34Z

Another 30 minutes complete. Prevention added.

Show changes

Azoundria at 20:39, 2 March 2023

2023-03-02T20:39:04Z

← Older revision		Revision as of 14:39, 2 March 2023
Line 142:		Line 142:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?


	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:Individuals:Placeholder}}		{{Prevention:Individuals:Placeholder}}

Azoundria at 20:37, 2 March 2023

2023-03-02T20:37:20Z

← Older revision		Revision as of 14:37, 2 March 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/optimismselfdestructexploit.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/optimismselfdestructexploit.php}}
			{{Unattributed Sources}}

	[[File:Optimism.jpg\|thumb\|Optimism]]Optimism is a layer 2 scaling solution on Ethereum. A critical bug existed in the protocol which would have allowed an attacker to mint additional unbacked Ethereum. The bug was only exploited once, apparently by accident with no loss of funds. On February 2nd, 2022, a white hacker named Jay Freeman found and reported it. The issue was fixed, and he received bounties that totaled $2.1m.		[[File:Optimism.jpg\|thumb\|Optimism]]Optimism is a layer 2 scaling solution on Ethereum. A critical bug existed in the protocol which would have allowed an attacker to mint additional unbacked Ethereum. The bug was only exploited once, apparently by accident with no loss of funds. On February 2nd, 2022, a white hacker named Jay Freeman found and reported it. The issue was fixed, and he received bounties that totaled $2.1m.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="protos-6823" /><ref name="cointelegraph-6824" /><ref name="sauriktwitter-6825" /><ref name="bobanetworktwitter-6826" /><ref name="optimismpbctwitter-6827" /><ref name="optimism-6828" /><ref name="optimismcommunity-6829" /><ref name="optimism-6830" /><ref name="saurik-6831" /><ref name="optimistic-6832" /><ref name="cryptoslate-6833" /><ref name="techtimes-6834" /><ref name="bitcoininsider-6835" /><ref name="immunefi-6836" /><ref name="optimismgateway-7805" /><ref name="amanusktwitter-8649" />

	== About Optimism ==		== About Optimism ==
Line 111:		Line 113:
	!Description		!Description
	\|-		\|-
	\|February 2nd, 2022 ~~12:00:00 AM~~		\|February 2nd, 2022
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 141:		Line 143:
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?

	== Prevention Policies ==
	~~Which policies could have prevented this event from happening?~~		== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	[https://protos.com/ether-hacker-optimism-ethereum-layer2-scaling-bug-bounty/ Hacker could've printed unlimited 'Ether' but chose $2M bug bounty instead] (Mar 1)		<references><ref name="protos-6823">[https://protos.com/ether-hacker-optimism-ethereum-layer2-scaling-bug-bounty/ Hacker could've printed unlimited 'Ether' but chose $2M bug bounty instead] (Mar 1, 2022)</ref>

	[https://cointelegraph.com/news/ios-jailbreak-dev-wins-2m-bounty-for-finding-critical-optimism-bug iOS jailbreak dev wins $2M bounty for finding critical Optimism bug] (Mar 4)		<ref name="cointelegraph-6824">[https://cointelegraph.com/news/ios-jailbreak-dev-wins-2m-bounty-for-finding-critical-optimism-bug iOS jailbreak dev wins $2M bounty for finding critical Optimism bug] (Mar 4, 2022)</ref>

	[https://twitter.com/saurik/status/1491821215924690950 @saurik Twitter] (Mar 4)		<ref name="sauriktwitter-6825">[https://twitter.com/saurik/status/1491821215924690950 @saurik Twitter] (Mar 4, 2022)</ref>

	[https://twitter.com/bobanetwork/status/1491989915336388618 @bobanetwork Twitter] (Mar 4)		<ref name="bobanetworktwitter-6826">[https://twitter.com/bobanetwork/status/1491989915336388618 @bobanetwork Twitter] (Mar 4, 2022)</ref>

	[https://twitter.com/optimismPBC/status/1491821983796895747 @optimismPBC Twitter] (Mar 4)		<ref name="optimismpbctwitter-6827">[https://twitter.com/optimismPBC/status/1491821983796895747 @optimismPBC Twitter] (Mar 4, 2022)</ref>

	[https://www.optimism.io/ Optimism] (Mar 4)		<ref name="optimism-6828">[https://www.optimism.io/ Optimism] (Mar 4, 2022)</ref>

	[https://community.optimism.io/docs/how-optimism-works/#introduction How Optimism Works \| Optimism Docs] (Mar 4)		<ref name="optimismcommunity-6829">[https://community.optimism.io/docs/how-optimism-works/#introduction How Optimism Works \| Optimism Docs] (Mar 4, 2022)</ref>

	[https://www.optimism.io/about About Optimism] (Mar 4)		<ref name="optimism-6830">[https://www.optimism.io/about About Optimism] (Mar 4, 2022)</ref>

	[https://www.saurik.com/optimism.html Attacking an Ethereum L2 with Unbridled Optimism - Jay Freeman (saurik)] (Mar 4)		<ref name="saurik-6831">[https://www.saurik.com/optimism.html Attacking an Ethereum L2 with Unbridled Optimism - Jay Freeman (saurik)] (Mar 4, 2022)</ref>

	[https://optimistic.etherscan.io/address/0x3d080421c9dd5fb387d6e3124f7e1c241ade9568 https://optimistic.etherscan.io/address/0x3d080421c9dd5fb387d6e3124f7e1c241ade9568] (Mar 4)		<ref name="optimistic-6832">[https://optimistic.etherscan.io/address/0x3d080421c9dd5fb387d6e3124f7e1c241ade9568 https://optimistic.etherscan.io/address/0x3d080421c9dd5fb387d6e3124f7e1c241ade9568] (Mar 4, 2022)</ref>

	[https://cryptoslate.com/critical-bug-in-ethereum-l2-optimism-2m-bounty-paid/ Critical bug in Ethereum L2 Optimism, $2M bounty paid \| CryptoSlate] (Mar 4)		<ref name="cryptoslate-6833">[https://cryptoslate.com/critical-bug-in-ethereum-l2-optimism-2m-bounty-paid/ Critical bug in Ethereum L2 Optimism, $2M bounty paid \| CryptoSlate] (Mar 4, 2022)</ref>

	[https://www.techtimes.com/articles/271714/20220211/optimism-awards-2-million-bounty-ios-jailbreak-developer-fixing-infinite.htm Optimism Awards $2 Million Bounty to iOS Jailbreak Developer After Fixing 'Infinite' ETH Bug \| Tech Times] (Mar 4)		<ref name="techtimes-6834">[https://www.techtimes.com/articles/271714/20220211/optimism-awards-2-million-bounty-ios-jailbreak-developer-fixing-infinite.htm Optimism Awards $2 Million Bounty to iOS Jailbreak Developer After Fixing 'Infinite' ETH Bug \| Tech Times] (Mar 4, 2022)</ref>

	[https://www.bitcoininsider.org/article/148376/optimism-pays-out-2-million-bounty-dev-discovering-critical-bug Optimism Pays Out $2 Million Bounty To Dev For Discovering Critical Bug \| Bitcoin Insider] (Mar 4)		<ref name="bitcoininsider-6835">[https://www.bitcoininsider.org/article/148376/optimism-pays-out-2-million-bounty-dev-discovering-critical-bug Optimism Pays Out $2 Million Bounty To Dev For Discovering Critical Bug \| Bitcoin Insider] (Mar 4, 2022)</ref>

	[https://immunefi.com/bounty/optimism/ Optimism Bug Bounties \| Immunefi] (Mar 4)		<ref name="immunefi-6836">[https://immunefi.com/bounty/optimism/ Optimism Bug Bounties \| Immunefi] (Mar 4, 2022)</ref>

	[https://gateway.optimism.io/welcome https://gateway.optimism.io/welcome] (May 29)		<ref name="optimismgateway-7805">[https://gateway.optimism.io/welcome https://gateway.optimism.io/welcome] (May 29, 2022)</ref>

	[https://twitter.com/amanusk_/status/1492085569521913861 @amanusk_ Twitter] (Jul 21)		<ref name="amanusktwitter-8649">[https://twitter.com/amanusk_/status/1492085569521913861 @amanusk_ Twitter] (Jul 21, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/optimismselfdestructexploit.php}} OptimismOptimism is a layer 2 scaling solution on Ethereum. A critical bug existed in the protocol which would have allowed an attacker to mint additional unbacked Ethereum. The bug was only exploited once, apparently by accident with no loss of funds. On February 2nd, 2022, a white hacker named Jay Freeman found and reported it. The is..."

2023-01-28T16:43:55Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/optimismselfdestructexploit.php}} thumb|OptimismOptimism is a layer 2 scaling solution on Ethereum. A critical bug existed in the protocol which would have allowed an attacker to mint additional unbacked Ethereum. The bug was only exploited once, apparently by accident with no loss of funds. On February 2nd, 2022, a white hacker named Jay Freeman found and reported it. The is..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/optimismselfdestructexploit.php}}

[[File:Optimism.jpg|thumb|Optimism]]Optimism is a layer 2 scaling solution on Ethereum. A critical bug existed in the protocol which would have allowed an attacker to mint additional unbacked Ethereum. The bug was only exploited once, apparently by accident with no loss of funds. On February 2nd, 2022, a white hacker named Jay Freeman found and reported it. The issue was fixed, and he received bounties that totaled $2.1m.

This is a global/international case not involving a specific country.

== About Optimism ==
"Optimism is a low-cost and lightning-fast Ethereum L2 blockchain."

"Optimism is an "Optimistic Rollup," which is basically just a fancy way of describing a blockchain that piggy-backs off of the security of another "parent" blockchain. Specifically, Optimistic Rollups take advantage of the consensus mechanism (like PoW or PoS) of their parent chain instead of providing their own. In Optimism's case this parent blockchain is Ethereum."

"Optimism is built according to a strong design philosophy that stands on four main pillars: simplicity, pragmatism, sustainability, and, of course, optimism."

"As few lines of code as possible separate Optimism from Ethereum's battle-tested infrastructure. Build your app on the L2 that doesn't quit." "Optimism is equivalent with the Ethereum Virtual Machine, not just compatible. This means all Ethereum apps and tooling just work."

"Optimism is a Public Benefit Corporation, a for profit corporation that is obligated to balance financial interests of our stockholders with the best interests of our community, and society."

"Not only are we writing software that scales Ethereum technology, we are also scaling Ethereum values by creating the rails for highly impactful projects that don’t have a business model to succeed. Read more about how we’re doing that here."
‍
"Until the project is fully decentralized, we will be donating all profits from running a centralized sequencer towards scaling and sustaining public goods."

"Software engineer Jay Freeman (who goes by Saurik online) didn’t leverage the exploit. Instead, he reported the issue to Optimism’s dev team." "On 2/2/2022, I reported a critical security issue to Optimism—an "L2 scaling solution" for Ethereum—that would allow an attacker to replicate money on any chain using their "OVM 2.0" fork of go-ethereum (which they call l2geth)."

"The bug presented here—which I dub "Unbridled Optimism"—can maybe be (crudely) modelled as a bug on the far side of a "bridge", but is actually a bug in the virtual machine that executes smart contracts on Optimism (an aforementioned L2 rollup)."

"Exploiting this enables the attacker to have access to an effectively unbounded number of tokens (aka, the IOUs) on the far side of the bridge. It is my contention that this is more dangerous than merely tricking the reserves into allowing a withdraw[a]l."

"With the ability to sneakily print IOUs (known on Optimism as OETH) on the other side of the bridge, you still can try to (slowly) withdraw money from the reserves, but now it will look like a legitimate transfer, making it easier to go unnoticed."

"(And, in case you believe that "someone would notice if the total number of IOUs were different than the amount of money locked in the reserves", this bug actually was triggered 40 days ago—as I will point out later—and no alarm bells were raised.)"

"Further, with your unbounded supply of IOUs, you could go to every decentralized exchange running on the L2 and mess with their economies, buying up vast quantities of other tokens while devaluing the chain's own currency."

"Using your access to infinite capital, you could further manipulate on-chain pricing oracles to leverage for other attacks\; and, until someone finally realizes your money is counterfeit, arbitragers will flock to the network to sell you their assets."

"This makes this bug capable of economic griefing attacks, wherein once someone notices—even if it is a mere hour later!—it might be "too late" to unravel what is and what isn't a legitimate transaction, calling into question the entire ledger."

"The UsingOVM flag is set with a USING_OVM environment variable (with no corresponding command line flag, as far as I know; that you need to set this environment variable while initializing the genesis block took me too long to figure out ;P)."

"Operations on the StateDB that affect an account balance are then redirected from the underlying stateObject (which represents an individual, cached account) to storage state in the OVM_ETH contract. Below is the code for state.StateDB.SetBalance."

"Now, there's actually already something interesting going on: s.GetOrNewStateObject has an observable side effect; but, when UsingOVM, this doesn't get called. This means that an account might own native currency without having an account object!"

"The exact issue here is that contracts are able to ask for the hash of the code of other accounts (which is sometimes used to verify their trusted behaviors). If an account has no code, its code is "", so its codehash is the hash of an empty buffer."

"However, if you ask for the codehash of an address that isn't currently backed by an object in the state trie, the codehash you get back is null. This observable effect is an example of the subtle incompatibilities that Optimism keeps experiencing."

"(If this were my project, I'd definitely have dropped everything long ago—pre-OVM 2.0—to prioritize removing this set of patches by fixing GetOVMBalanceKey to store hash preimages, re-executing the chain, and then swapping out the state trie.)"

"The code for Suicide is still directly modifying the stateObject's data.Balance field instead of checking UsingOVM and redirecting that modification to OVM_ETH."

"This means that, when a contract self-destructs, its balance is BOTH given to the beneficiary AND ALSO KEPT. If the contract had 10 OETH, 10 OETH are CREATED from thin bits and handed to the beneficiary."

"One of the questions we often want to answer is "has anyone else already pulled off an exploit using this bug?". To answer this, I instrumented the code for the OVM 2.0 to log any time a transaction destroyed a contract with a balance."

"As SELFDESTRUCT is already a rare opcode, and this is even then a subset of all uses of SELFDESTRUCT—and further, as OVM 2.0 was only released three months ago—there was only a single user who had ever tried this: on Christmas Eve (2021)."

"In those transactions (as seen on the Optimism block explorer hosted by Etherscan) we see a user creating and destroying three contracts. The first two times, the contract's beneficiary is the 0x0 address, while the third time it is the user themself."

"It frankly felt like someone had noticed the bug—seeing that Etherscan left the balance in place after the contract was destroyed—and even played with it a bit (to see if this was a behavior of 0x0)... but hadn't realized it was exploitable."

"I actually managed to track down this user (!!) and it turns out they work for Etherscan ;P. It just goes to show that sometimes even people who are staring directly at a bug don't always see the indirect security implications."

"Last week, I discovered (and reported) a critical bug (which has been fully patched) in @optimismPBC (a "layer 2 scaling solution" for Ethereum) that would have allowed an attacker to print arbitrary quantity of tokens, for which I won a $2,000,042 bounty."

"I'd missed the confirmation of this on Thursday, but @bobanetwork had decided to additionally extend to me their (maximum) $100k bug bounty payout, making the total reward for my Ethereum L2 bug--"Unbridled Optimism"--$2,100,042! (...I think this might actually set a new record?)"

"[Optimism] paid him a $2-million bug bounty."

"We thank Jay Freeman (@saurik) for his amazing detective work in discovering and then reporting the print-ETH vulnerability to Optimism." "In appreciation for @saurik’s deep detective work on this critical vulnerability, we have offered him the maximum amount in our bug bounty program."

"Optimism—whose platform currently uses a centralized "sequencer"—moved to both fix this bug on their nodes and infrastructure, as well as arrange for downstream projects that used their codebase (Boba and Metis) to get patched."

"Last week we patched a critical bug in the Optimism codebase, discovered by @saurik." "We’re incredibly thankful to saurik for spending so much time analyzing our protocol over the year--enough to find such an important fix! We highly recommend you check out his in-depth breakdown. We'll award the full $2,000,042 promised in our bug bounty."

"Optimism did a superb job fixing the vulnerability and working with all ORs and Infra providers to roll out a patch across the OR ecosystem within hours. Your funds are safe and Boba was patched within three hours of the vulnerability being reported."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Optimism Self Destruct Exploit
!Date
!Event
!Description
|-
|February 2nd, 2022 12:00:00 AM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
No funds were lost.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

A bounty of $2,100,000 USD was paid for the discovery.

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Which policies could have prevented this event from happening?

== References ==
[https://protos.com/ether-hacker-optimism-ethereum-layer2-scaling-bug-bounty/ Hacker could've printed unlimited 'Ether' but chose $2M bug bounty instead] (Mar 1)

[https://cointelegraph.com/news/ios-jailbreak-dev-wins-2m-bounty-for-finding-critical-optimism-bug iOS jailbreak dev wins $2M bounty for finding critical Optimism bug] (Mar 4)

[https://twitter.com/saurik/status/1491821215924690950 @saurik Twitter] (Mar 4)

[https://twitter.com/bobanetwork/status/1491989915336388618 @bobanetwork Twitter] (Mar 4)

[https://twitter.com/optimismPBC/status/1491821983796895747 @optimismPBC Twitter] (Mar 4)

[https://www.optimism.io/ Optimism] (Mar 4)

[https://community.optimism.io/docs/how-optimism-works/#introduction How Optimism Works | Optimism Docs] (Mar 4)

[https://www.optimism.io/about About Optimism] (Mar 4)

[https://www.saurik.com/optimism.html Attacking an Ethereum L2 with Unbridled Optimism - Jay Freeman (saurik)] (Mar 4)

[https://optimistic.etherscan.io/address/0x3d080421c9dd5fb387d6e3124f7e1c241ade9568 https://optimistic.etherscan.io/address/0x3d080421c9dd5fb387d6e3124f7e1c241ade9568] (Mar 4)

[https://cryptoslate.com/critical-bug-in-ethereum-l2-optimism-2m-bounty-paid/ Critical bug in Ethereum L2 Optimism, $2M bounty paid | CryptoSlate] (Mar 4)

[https://www.techtimes.com/articles/271714/20220211/optimism-awards-2-million-bounty-ios-jailbreak-developer-fixing-infinite.htm Optimism Awards $2 Million Bounty to iOS Jailbreak Developer After Fixing 'Infinite' ETH Bug | Tech Times] (Mar 4)

[https://www.bitcoininsider.org/article/148376/optimism-pays-out-2-million-bounty-dev-discovering-critical-bug Optimism Pays Out $2 Million Bounty To Dev For Discovering Critical Bug | Bitcoin Insider] (Mar 4)

[https://immunefi.com/bounty/optimism/ Optimism Bug Bounties | Immunefi] (Mar 4)

[https://gateway.optimism.io/welcome https://gateway.optimism.io/welcome] (May 29)

[https://twitter.com/amanusk_/status/1492085569521913861 @amanusk_ Twitter] (Jul 21)