BTC

$96806.595

1.41%

ETH

$3430.099

1.61%

XRP

$2.23

1.83%

BNB

$704.971

1.18%

Blockchain

Aurora Pays $2 Million To Hackers Who Discovered The Bug

September 30, 2022 - Around 2 mins mins to read
Aurora paid $2 million to a pair of hackers who discovered significant flaws.
Aurora Pays $2 Million To Hackers Who Discovered The Bug

No user funds were lost as a result of the EVM scaling and bridge solution. The two $1 million bounties were awarded in the company’s native cryptocurrency AURORA and will be paid out in a year’s time. The ImmuneFi bug bounty platform handled the payments.

The vulnerability was identified on June 10 by security company Halborn and was revealed earlier today.

Aurora is a Layer 2 scaling solution and EVM-compatible bridge between the Layer 1 NEAR protocol and Ethereum. The initial vulnerability was caused by Aurora’s use of a separate ERC-20 (fungible token standard) known as NEP-141.

Aurora Pays $2 Million To Hackers Who Discovered The Bug

The bridge between the two chains is permissionless, which means that anybody may bridge over any token to any address without their knowledge.

An attacker may have produced a worthless NEP-141 token on NEAR, bridged it to Aurora, and then distributed it to unwitting victims. As a result, attackers would be able to “take ETH from Aurora addresses essentially for free,” according to the report. This is due to the bridge’s ability to charge the recipient or victim a fee denominated in ETH.

Aurora Pays $2 Million To Hackers Who Discovered The Bug

The second vulnerability was related to the bridge’s burning feature. Tokens are burnt on one chain and debited on the other when users bridge funds from one network to another.

An assailant may have staged a “fake burn event” without it really happening. This bogus event might then be used to take funds from the Ethereum locker, which is the Aurora bridge’s stored amount of ETH utilized for chain bridging.

DISCLAIMER: The Information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.

Join us to keep track of news: https://linktr.ee/coincu

Website: coincu.com

Harold

CoinCu News

aurora

EVM

Halborn

immunefi

NEP-141 token

Author

Harold

With a passion for untangling the complexities of the financial world, I've spent over four years in financial journalism, covering everything from traditional equities to the cutting edge of venture capital. "The financial markets are a fascinating puzzle," I often say, "and I love helping people make sense of them." That's what drives me to bring clear and insightful financial journalism to the readers of Coincu.