Another cryptocurrency vulnerability has been discovered by a so-called white hat hacker, who discovered an exploitable hole in the bridge between Ethereum and Arbitrum Nitro.
The hacker, known as riptide on Twitter, detailed their discovery, which comes on the heels of an accelerating spate of hacks in the bridges that connect multiple blockchains, which have together robbed hundreds of millions of dollars of primarily user funds this year.
Arbitrum, the layer-2 Ethereum scaling solution, awarded riptide a bounty of 400 ether (ETH) via the bug bounty platform ImmuneFi.
According to riptide, the multi-million dollar vulnerability would have allowed an attacker to steal any incoming ether deposits from consumers attempting to bridge their assets across Ethereum layer-1 and layer-2 protocols to Arbitrum.
According to the white hat hacker, the initialization-related vulnerability would have allowed any malicious actor to impersonate a user and transmit the authentication message to the “sequencerInbox” function to execute the exploit.
According to riptide, the greatest deposit recorded on the inbox contract was 168,000 ETH, or around $250 million, with average contributions ranging from 1,000 to 5,000 ETH in a 24-hour period.
Another Twitter user, smartcontracts.eth, stated that “rollups are still heavily under development,” warning his followers to be cautious while using layer-2 protocols. A layer-2 is a mechanism that is placed on top of a blockchain's core layer, often to boost scalability or performance while also introducing new features.
A similar issue was discovered in the token bridge Nomad's smart contract, costing the protocol $190 million in cryptocurrency in the year's third-largest cryptocurrency breach.
Arbitrum recently released Nitro, one year after the now-defunct original incarnation of the rollup and ahead of the Merge.
Arbitrum NFTs
Arbitrum also expects to merge with the NFT marketplace OpenSea on Wednesday.
A spate of NFT collections created on Arbitrum will be available for direct purchase and sale on OpenSea.
OpenSea stated on Twitter that creators will need to find their collections and set their own creator fees.
The marketplace has moved royalty percentages to the top of a collection's page.