The $10 million Ronin bridge exploit on Aug. 6 was caused by a faulty upgrade deployment script, according to a report from blockchain security firm Verichains.
The upgrade reduced the voting threshold for validators to zero, essentially allowing any user to withdraw from the bridge “without signature,” Verichains stated.
The bot’s owner later returned most of the funds to the Ronin team.
Verichains’ analysis lays bare the risks that users take when they interact with upgradeable smart contracts. The protocol could have lost the full amount had the attacker paid more in gas and, therefore, avoided the frontrunner.
Ronin is a blockchain network dedicated to hosting Web3 games. It is most well-known for being the home of Axie Infinity, a play-to-earn monster breeding game that claimed to have over 2 million players during its peak in 2022. Ronin game players use the bridge to transfer funds between Ethereum and Ronin.
According to Verichains’ report, the bridge relies on the variable mimimumVoteWeight to prevent users from withdrawing funds that don’t belong to them. Each transaction must be authorized by a minimum number of validators set by this variable. When minimumVoteWeight is computed, it uses another variable, totalWeight, as an input.
TotalWeight in a previous version of Ronin. Source: Verichains
In earlier versions of the bridge, totalWeight existed on a separate contract, called “MainchainBridgeManager.” When the developers created the new upgrade, they wanted to move this variable to the bridge’s own internal storage, instead of leaving it in the other contract. This meant that they needed to initialize the variable at the moment of deployment, setting TotalWeight to the value it had been in the previous version.
Unfortunately, this is where the upgrade went horribly wrong. According to Verichains, the Ronin developers wrote several different “initialize” functions that were supposed to be called at the moment of deployment. Each of these functions had a different version number….
..
