White Hat Hacker Receives $ 2 Million For Disclosing DeFi’s Most ‘Expensive’ Bug Yet
Polygon, a red-hot smart contracts platform and L2 decentralized finances hub, shares the details of the largest possible hack in DeFi history.
How to Earn $ 850 Million Resubmitting Polygon Transactions
According to the official post-mortem released by Immunefi, a multi-product bug bounty platform, in early October 2021, hacker Gerhard Wagner submitted a bug report to Polygon (MATIC).
According to this report, the flaw in Polygon’s scaling solution, Plasma, allowed it to resubmit the burn transaction multiple times. The perpetrator could send the withdrawn requests to Polygon over and over again, up to 223 times.
To compromise Polygon Plasma Bridge, an attacker needed to just slightly modify some technical parameters of transactional data, i.e., the “first byte of the branch mask.”
Considering the total amount of funds stranded in the bridge deposit manager’s proxy, more than $ 850 million in user funds were at risk.
Largest threat, largest bounty
As such, Polygon could have been targeted by the largest attack in the history of DeFi segment: the current “leader,” Poly Network, suffered from a $611 million exploit.
The Polygon team awarded Mr. Wagner the biggest bug bounty bonus ever, $ 2,000,000 plus commission from the Immunefi platform. The team responded to Immunefi’s report in 30 minutes and confirmed the bug.
The team stress that no user is at risk at the moment, and this white hat hack should be a lesson for DeFi apps:
No user funds were lost (…) Let’s build and make web 3.0 more resilient from such future attacks.
