iOS Jailbreak Developer Gets $2M for Discovering Critical Optimism Vulnerability

Developers of the Ethereum layer 2 scaling project Optimism have announced that a "critical bug" has been discovered and subsequently patched earlier this month.

The bug, which would have allowed hackers to create as much "ETH" as possible in Optimism account balances, was originally discovered by white hat hacker and iOS jailbreak Cydia developer Jay Freeman.

In an in-depth blog post, Freeman explained that the vulnerability "would allow an attacker to replicate funds on any chain using their 'OVM 2.0' fork of go-ethereum". For his efforts, Freeman received one of the largest bug bounties to date, with a total reward of $2,000,042

According to the Optimism team, "The bug made it possible to create ETH on Optimism by repeatedly triggering the SELFDESTRUCT opcode on the contract holding the ETH balance."

In a blog post, the Optimism team noted that its chain history shows that, apart from an accidental activation of the vulnerability by a worker at ethereum data startup Etherscan (which resulted in no additional exploits being available), the vulnerability was not exploited.

“A fix for this issue was tested and deployed to Optimism’s Kovan and Mainnet networks (including all infrastructure providers) within hours of confirmation,” the team said, thanking Infura, QuickNode, and Alchemy for their quick responses.

"We're also alerting several vulnerable Optimism fork and bridge providers to the existence of the issue. These projects have all applied the required fixes."

At the end of last year, Optimism removed its whitelist (allowing any developer to start building projects on the Optimism network). Before this, the network was only available to specific projects like Uniswap and Synthetix. This limitation makes it easier for developers to detect and address potential vulnerabilities.

Optimism is a layer 2 scaling solution for the Ethereum network that employs "optimistic rollups" to aggregate transactions outside the Ethereum blockchain.

This offers the benefits of reduced slippage, reduced transaction costs and greatly increased transaction speed. However, as this bug demonstrates, while layer 2 protocols improve efficiency, security during ongoing development remains a common concern.

While the bounty is the largest paid out to date, MakerDAO has just announced that it will be offering up to $10 million to anyone who can point to a serious security threat in its smart contracts. This is the largest bug bounty series to date hosted on the bug bounty platform Immunefi.