News for hackers. Stuff that matters.
Re:White hat hacker awarded $2M for fixing ETH-creation bug by SilasX on Sunday February 13, 2022 @11:08AM (#30322686)
But you could drain out all the ETH in the Optimism reserve by asking to withdraw, since you've fooled the network into thinking you own an arbitrary amount of OETH? Which would keep working until the main L1 Eth network rejects transactions for transferring ETH it doesn't have?
Re:White hat hacker awarded $2M for fixing ETH-creation bug by londons_explore on Sunday February 13, 2022 @12:29PM (#30323514)
Or until someone notices...

All the balances and stuff are public on the blockchain. It only takes one person to write a script to verify that the locked up amount matches the number of tokens out there. and when it doesn't, alert.

That then means any attacker will have to be very quick with their theft, and if so, there is still a good chance whatever coins they get will end up blacklisted or the transactions reversed by a sufficiently large army of upset users who fork the eth network or the L2 network.

Re:White hat hacker awarded $2M for fixing ETH-creation bug by easrng on Sunday February 13, 2022 @01:29PM (#30324173)
Just get the ETH into Tornado Cash ASAP, that should avoid any potential blacklisting.
Re:White hat hacker awarded $2M for fixing ETH-creation bug by sizzle on Sunday February 13, 2022 @04:34PM (#30325909)
I mean even if you got it in there after blacklisting, how would they know the wallet that received it?
Re:White hat hacker awarded $2M for fixing ETH-creation bug by pshc on Sunday February 13, 2022 @12:56PM (#30323792)
The folks at Optimism would certainly hit the pause button on that withdrawal before it escaped, if there aren't already limits and automatic controls in place. It takes 7 days to withdraw L2->L1 via the standard bridge.

(They have administrative controls for now during development, at some point they're supposed to turn it completely permissionless...)

Re:White hat hacker awarded $2M for fixing ETH-creation bug by SilasX on Sunday February 13, 2022 @01:37PM (#30324258)
You don't have to use the standard bridge though; I've withdrawn in less than five minutes using the Hop bridge/network, which I think just involves an additional fee to a middleman (my L1 transaction for it shows it spending ~0.02 ETH). I can't speak to what additional checks that protocol may have that would have prevented conversion of excess OETH though. Here's the FAQ for it:

https://help.hop.exchange/hc/en-us/sections/4405172442509-FA...

Edit: O...kay? Apparently the parent of this comment is aware of alternate, much-faster ways of withdrawing L2->L1, and what their constraints are, but still elected to leave those out and imply the one-week lag was a binding constraint?

(Would have posted as a reply, but my comment rate is getting throttled for some reason.)

Re:White hat hacker awarded $2M for fixing ETH-creation bug by pshc on Sunday February 13, 2022 @01:50PM (#30324383)
I've used Hop too. Transfers are naturally limited to however much liquidity Hop has, though.

Edit: Sorry for being disingenuous and unnecessarily curt in my reply. I didn't mean to. I'm in some kind of weird zombie mode this morning.