1. Home
  2. bounty

bounty

Cosmos patches ‘critical’ IBC protocol bug saving $126M

IBC has always had the bug but it only recently became exploitable due to developments in the protocol’s codebase, Asymmetric Research said.

Cosmos developers have fixed a “critical” security bug in its Inter-Blockchain Communication (IBC) protocol which put at least $126 million at risk, says a blockchain security firm that privately notified Cosmos of the issue.

“We privately disclosed the vulnerability through the Cosmos HackerOne Bug Bounty program and the issue is now patched,” Asymmetric Research said on April 23.

“No malicious exploitation took place and no funds were lost,” it added.

Read more

Ex-Florida congressman joins Coinbase Global Advisory Council

Stars Arena recovers 90% of stolen funds after offering $257K bounty

The exploiter of the Web3 social media platform agreed to keep a 10% bounty in exchange for returning the remainder of the stolen funds.

Web3 social media platform Stars Arena says it has recovered nearly all of the crypto stolen from an Oct. 7 exploit — minus a 10% bounty to the person responsible.

In an Oct. 11 X (Twitter) post, Stars Arena said around 90% of the 266,000 Avalanche (AVAX) exploited, at the time worth around $3 million, was returned after reaching an agreement to give a 27,610 AVAX bounty worth nearly $257,000 to the exploiter.

The bounty also included compensation for 1,000 AVAX worth over $9,000 seemingly lost by the exploiter in a bridge.

In a separate post, Stars Arena added it had written a new smart contract and before placing the returned funds and launching, it was finalizing an audit of the new contract.

Stars Arena first alerted its community to the exploit on Oct. 7, calling it a “major security breach” with its smart contract leading to funds being drained.

In a subsequent post, Stars Arena said it secured funding to plug the hole left by the exploit and it had contracted a development team to do a full security audit, though the team has yet to detail how the exploit took place.

Related: Galxe replacing 110% of funds users lost in recent front-end hack, over $400K

Days earlier, on Oct. 5, Stars Arena was hit by a smaller exploit, though hackers only made off with around $2,000, they claimed.

The exploit was caused by Stars Arena developers missing a vulnerable price function in the platform’s smart contract. This allowed the exploiter to sell user shares for nothing and get AXAX in return, pseudonymous X user “0xlilitch” explained in a post.

Stars Area claimed to have patched the vulnerability.

Users of Stars Arena’s main competitor, Friend.tech, have also seen targeted SIM-swap attacks with Friend.tech recently adding security features to mitigate the attempts.

Magazine: Recursive inscriptions — Bitcoin ‘supercomputer’ and BTC DeFi coming soon

Ex-Florida congressman joins Coinbase Global Advisory Council

Binance Announces Support for New ‘Intel-to-Earn’ Altcoin Project Launch

Binance Announces Support for New ‘Intel-to-Earn’ Altcoin Project Launch

The world’s largest crypto exchange platform by volume is announcing support for a new “intel-to-earn” altcoin project that lets users buy and sell on-chain crypto data. In a new company announcement, Binance says that it’s rolling out support for Arkham (ARKM), the native token of an intelligence exchange where buyers can place bounties on specific […]

The post Binance Announces Support for New ‘Intel-to-Earn’ Altcoin Project Launch appeared first on The Daily Hodl.

Ex-Florida congressman joins Coinbase Global Advisory Council

Coinbase layer-2 network Base closes in on mainnet launch

While a date for mainnet wasn’t announced, the Base team said it’s now fulfilled 4 out of 5 of their criteria for launch.

Base, a new layer 2 application-focused protocol by Coinbase has just one criteria left to fulfil  before being ready for mainnet launch.

On June 29, the team said the Optimism-powered, Ethereum-secured network has been subject to six months of rigorous security audits — both internally and externally — its second-last criteria required for launch.

“With the completion of these audits, we’ve now fulfilled ⅘ of our criteria for mainnet launch,” Base said, adding that they feel confident after not finding any critical code bugs:

“Completing these in-depth security workstreams without discovering critical severity bugs gave the Base team confidence to proceed towards mainnet launch.”

The other three criteria passed included a “Regolith” hard fork in testnet, a successful infrastructure review with OP labs — the team behind Optimism — and Optimism’s “Bedrock” upgrade.

Coinbase officially launched Base on February 23, which aims to be a low-cost, secure, developer-friendly network for building decentralized applications.

To “battle-test” Optimism’s tech stack, Coinbase’s protocol security team conducted its own internal audit to identify any vulnerabilities that may emerge on layer 1, layer 2 and on the bridges.

In addition to Coinbase's internal audit, Base invited the broader community to partake in a public smart contract audit test via Code4rena to report bugs found in the Optimism’s tech stack:

“We engaged over 100 security researchers as part of this contest, and are happy to report there were no significant vulnerabilities discovered.”

Among the audits investigated by the security researchers included Optimism’s node software, Ethereum Virtual Machine (EVM) equivalence vulnerabilities, bridge vulnerabilities and miscellaneous smart contract issues.

The community audit ran from May 27 to June 10 with a maximum of $100,000 in rewards handed out to successful bounty hunters.

Demonstrating “testnet stability” is the final criteria that needs to be passed prior to mainnet launch, according to a previous post from Base.

The five criteria required for Base to launch on mainnet. The timeline provided by Base was published on May 25. Source: Base

While Base didn’t state how the final criteria would be fulfilled exactly, the team said that they’re still reviewing submissions from the 100 researchers that took part in the public smart contract audit in addition to reviews from past audit programs — namely “spearbit” and “sherlock.”

Base added that they’ve built Pessimism, an open source monitoring tool which aims to notify builders of any anomalies that may arise in the protocol, such as account balance irregularities, contract events, or disparities between L1 and L2 states.

Related: Coinbase CEO says Bitcoin Lightning is 'something we’ll integrate'

In late March, Coinbase said they want to see an inflation-pegged “flatcoin,” an on-chain reputation system and an on-chain limit order book exchange built on Base.

Many considered the development of Base to be a “massive vote of confidence for Ethereum” when the news was first announced in late February.

Secured on Ethereum and powered by layer-2 network Optimism, Base aims to eventually become a network for building decentralized applications.

Magazine: ’Account abstraction’ supercharges Ethereum wallets: Dummies guide

Ex-Florida congressman joins Coinbase Global Advisory Council