A Twitter user successfully stopped a potential attack on a cross-chain bridge
The BitBTC bridge included a weakness that would effectively let an attacker print phoney tokens on one side of the bridge and exchange them for genuine ones
Image: Shutterstock
Thanks to the diligence of a sharp-eyed Twitter user, a cross-chain bridge between BitBTC and the Ethereum layer-2 network Optimism was able to escape potentially expensive abuse.
L2 network Abirtrum tech lead Lee Bousfield called attention to the BitBTC bridge flaw in a message on Twitter on October 18 and stated that "BitBTC's Optimism bridge is trivially vulnerable. Their team has ignored my messages, so I'm going to publish the critical exploit here."
The BitBTC bridge, according to Bousfield, included a fault that would allow a hacker to create phoney tokens on one side of the bridge and exchange them for genuine ones on the other.
"Any token may be withdrawn from the Optimism L2 side of the bridge, and the token may choose the L1Token address sent to the L1 side of the bridge. But the L1 bridge merely goes on and mints the random L1 token, disregarding what the L2 token was!" said Bousfield. In order to successfully exploit the problem it would reportedly take '7 days to go past, during which an upgrade might patch the L1 bridge.' As soon as this was noted, someone tried to test the notion by attempting to withdraw '200 billion bogus BitBTC from Optimism.'
It was allegedly a mere test, according to the attacker. Around 10 hours later, in a follow-up statement, Bousfield also mentioned that the problem had been fixed due to his communication with the BitBTC team. To validate these specifics, Cointelegraph has contacted the BitAnt team. If they answer, the report will be updated.
