Monday , August 15 2022
Home / Blockchain / DeFi Crisis Averted: NEAR Protocol’s Rainbow Bridge Attacker Loses 2.5 ETH

DeFi Crisis Averted: NEAR Protocol’s Rainbow Bridge Attacker Loses 2.5 ETH

Summary:
On May 1, the NEAR Protocol Rainbow Bridge was attacked. The cross-chain bridge had temporarily been suspended for maintenance after detecting abnormal activities. In a detailed post, Alex Shevchenko, CEO of Aurora Labs, revealed that the attack was stopped automatically as the bridge architecture was designed to resist such events. No funds were lost during the event, Shevchenko added. The Attack It all started when the attacker sent some ETH through the popular coin mixer, Tornado Cash, on May 1. They deployed a contract meant to deposit some funds to become a valid Rainbow Bridge relayer. The main intention was to send “fabricated” light client blocks. According to Shevchenko, the bridge watchdogs identified that the block submitted was not in the NEAR blockchain and,

Topics:
Chayanika Deka considers the following as important: , , , ,

This could be interesting, too:

Dimitar Dzhondzhorov writes All That Glitters is Not Gold: UN Agency Slams Crypto Adoption

Mandy Williams writes Over 1.2 Billion aUSD Minted in an Exploit of Polkadot’s DeFi Hub Acala

Dimitar Dzhondzhorov writes Over 75% of Financial Institutions Intend to Use Crypto in the Next Three Years (Study)

Dimitar Dzhondzhorov writes Hackers Have Drained .4 Billion Worth of Crypto Since the Beginning of 2022 (Research)

On May 1, the NEAR Protocol Rainbow Bridge was attacked. The cross-chain bridge had temporarily been suspended for maintenance after detecting abnormal activities.

In a detailed post, Alex Shevchenko, CEO of Aurora Labs, revealed that the attack was stopped automatically as the bridge architecture was designed to resist such events. No funds were lost during the event, Shevchenko added.

The Attack

It all started when the attacker sent some ETH through the popular coin mixer, Tornado Cash, on May 1. They deployed a contract meant to deposit some funds to become a valid Rainbow Bridge relayer.

The main intention was to send “fabricated” light client blocks. According to Shevchenko, the bridge watchdogs identified that the block submitted was not in the NEAR blockchain and, in turn, created a “challenge transaction” and sent it to Ethereum.

After the watchdog transaction failed, MEV bots figured that front-running it would result in a 2.5 ETH gain. The exec explained,

“As a result, watchdog transaction failed, MEV bot transaction succeeded and rolled back the fabricated block of the attacker. Some min after this, our relayer submitted a new block. A bit later we started to investigate the strange behavior and paused all the connectors. And once figured out the details, unpaused them back.”

He then revealed that the attack was mitigated fully automatically, and the users continued their transactions in both directions. Shevchenko also noted that the NEAR protocol will take additional measures to ensure the cost of an attack attempt is increased – meaning – the stake for the relayer is expected to rise manyfold, so similar endeavors would cost much more. The focus should be on security and robustness, explained the CEO.

“I wish everyone who is innovating in the blockchain to pay enough attention to security and robustness of their products through all the available means: automatic systems, notifications, bug bounties, internal and external audits.”

DeFi Bridge Attacks

In recent months, blockchain bridges have become prime targets for attacks. In one of the biggest heists in the history of cryptocurrency, attackers managed to steal $620 million worth of Ethereum and USDC stablecoin from Axie Infinity’s Ronin Network after targetting Ronin Bridge, which allows users to move funds between the network and Ethereum.

Earlier this year, Qubit Bridge lost $80 million worth of cryptocurrency, while Wormhole Bridge lost $320 million just weeks later.

You Might Also Like:

Leave a Reply

Your email address will not be published. Required fields are marked *