Perpetual Protocol

Blockchain security firm Chainlight said it received a $10,000 bounty for uncovering a potential vulnerability that could have jeopardized $32 million in customer funds on Optimism-based decentralized exchange (<a href="https://cryptoslate.com/glossary/dex/" rel="noopener noreferrer nofollow">DEX</a>) Perpetual Protocol.
In a Nov. 9 <a href="https://x.com/ChainLight_io/status/1722649756852462051?s=20" rel="noopener noreferrer nofollow">post</a> on social media platform X (formerly Twitter), Chainlight detailed how it reported a critical bug in Perpetual Protocol’s “AccountBalance” contract last year. According to the firm, the contract is a pivotal component that “serves as the protocol’s brain for calculating position values.”
The vulnerability posed a severe threat to the DEX, placing the entire $32 million <a href="https://cryptoslate.com/coins/usd-coin/" rel="noopener noreferrer nofollow">USDC</a> held by the protocol at risk of being misappropriated.
This flaw had the potential to allow bad actors to swiftly move the entire $32 million within a five-minute timeframe, leaving the protocol with insufficient time to deploy effective security measures.
The <a href="https://cryptoslate.com/optimism-hacker-confirms-they-are-whitehat-returns-most-of-stolen-funds/" rel="noopener noreferrer nofollow">white-hat hacker</a> detailed that an attacker could manipulate asset prices through a pump-and-dump strategy, exploiting volatile price actions to place position orders outside the permissible range and immediately profit, resulting in the protocol’s bad debt.
In acknowledgment of its efforts, Chainlight said it got $10,000 worth of Perpetual Protocol’s native <a href="https://cryptoslate.com/coins/perpetual-protocol/" rel="noopener noreferrer nofollow">PERP</a> tokens.
<h2 id="perpetual-protocol-s-low-bounty-draws-critics">Perpetual Protocol’s low bounty draws critics</h2>
The $10,000 bounty has generated several reactions from the crypto community, who argue it was insufficient considering the protected amount.
Trust, the head of security at blockchain auditing firm TrustSec, <a href="https://x.com/trust__90/status/1722673279456989527?s=20" rel="noopener noreferrer nofollow">labeled</a> the reward as another instance of a bounty scam, asserting that it did not adequately reflect the gravity of the situation.
Protocol Specialist at <a href="https://cryptoslate.com/companies/coinbase/" rel="noopener noreferrer nofollow">Coinbase</a>,&nbsp;Viktor Bunin, also <a href="https://x.com/ViktorBunin/status/1722730489843273852?s=20" rel="noopener noreferrer nofollow">questioned</a> why the bounty was so low.
Juancito, a blockchain security researcher, <a href="https://x.com/0xJuancito/status/1722706607765602770?s=20" rel="noopener noreferrer nofollow">criticized</a> the meager bounty offer, suggesting that white-hat hackers’ contributions to the ecosystem are not appropriately valued.
Similarly, Blurpoint <a href="https://x.com/SafuNotSifu/status/1722820341100347866?s=20" rel="noopener noreferrer nofollow">noted</a> that white-hat efforts often go unappreciated, emphasizing the importance of acknowledging and adequately compensating these contributions.
Web3 security expert CryptoBandit <a href="https://x.com/banditx0x/status/1722689053265727624?s=20" rel="noopener noreferrer nofollow">shared</a> a comparable experience, recounting how he shared a critical vulnerability that could have led to $40 million in losses with the DEX but only got $30,000 as bounty rewards.
This situation underscores the challenges white-hat hackers face within the industry, as they are not properly <a href="https://cryptoslate.com/white-hat-hacker-grumbles-over-arbitrum-bounty-reward-after-saving-network-from-475m-loss/" rel="noopener noreferrer nofollow">incentivized to help crypto platforms</a> expose vulnerabilities within their codes.
The post <a href="https://cryptoslate.com/32-million-vulnerability-in-perpetual-protocol-uncovered-by-chainlight-nets-10k-white-hat-reward/" rel="noopener noreferrer nofollow">$32M vulnerability in Perpetual Protocol uncovered by Chainlight nets $10k in white hat rewards</a> appeared first on <a href="https://cryptoslate.com" rel="noopener noreferrer nofollow">CryptoSlate</a>.

$32M vulnerability in Perpetual Protocol uncovered by Chainlight nets $10k in white hat rewards

Table of Contents

CryptoSlate

Other articles published on Nov 10, 2023

Future Contracts

7 Good Reasons to Attend Sigma Europe 2023

India tightens control with 3,000 police officials trained in crypto investigations

Zcash

Cryptography

[9C M] Monthly Newsletter - Nov 2023

Join our free newsletter for daily crypto updates!