Researcher Earns $2 Million for Critical Vulnerability in Polygon

guest · Oct 25, 2021

Researcher Earns $2 Million for Critical Vulnerability in Polygon
October 25, 2021
https://www.securityweek.com/researcher-earns-2-million-critical-vulnerability-polygon

Specifically, a user could deposit a specific amount to the Polygon Plasma Bridge, withdraw the entire sum, and then submit the same withdrawal transaction an additional 223 times, each time receiving the full amount. Basically, one could deposit $1 million and withdraw $224 million.

With the DepositManager for the Plasma Bridge holding roughly $850 million in total, an attacker could have depleted the entire amount using multiple fraudulent transactions.
Click to expand...

What Wagner discovered was that the manner in which Polygon’s WithdrawManager checks inclusion and uniqueness of the burn transaction was flawed.

In the end, the white hat hacker discovered that the security error allowed for a total of 224 ways of decoding the same path, meaning that a malicious user could essentially create 224 exit IDs for the same withdraw transaction.

“Then the attack is launched, and 223 alternative exit payloads are generated with the technique described above, and exits are initiated for each one of them. All exits get a unique id and are added to the exit queue. Their age is already older than the challenge period since the burn transaction has been aggregated into a Plasma block, so the funds can be released,” Wagner explains.
To correct the issue, Polygon is demanding that the first byte of the encoded branch mask is always 0x00, and rejects all other encodings.
Click to expand...

Log in or Sign up

Researcher Earns $2 Million for Critical Vulnerability in Polygon

guest Guest

Log in or Sign up

Researcher Earns $2 Million for Critical Vulnerability in Polygon

guest Guest

Useful Searches