Beosin: Analysis of abnormal cross-chain asset extraction behavior in the Ronin Bridge project

According to Beosin Alert, a blockchain security audit company, the Ronin Bridge project has abnormally extracted cross-chain assets. According to the analysis of the Beosin security team, the root cause of this abnormal behavior is that when the project upgraded the contract, the operator weight required for cross-chain transaction confirmation was not initialized properly, resulting in the minimumVoteWeight parameter in the contract being zero, so that anyone's signature can pass the cross-chain verification. At present, Ronin bridge has lost 3,996 ETH, and the funds are stored at 0xc6aec68dd6272efcbc74fb5308fe7f070437465e (this address is a MEV bot, so it is speculated that it may be a white hat behavior). Beosin is currently working with the project to deal with this incident.