random

Random

Bank AI

Chainlink

Decentralized oracle network Chainlink (<a href="https://cryptoslate.com/coins/chainlink/" rel="noopener noreferrer nofollow">LINK</a>) paid a $300,000 bounty to white hat hackers Zach Obront and Or Cyngiser (Trust), who uncovered a critical bug that could have skewed its Verifiable Random Function (VRF).
<h2 class="s3" id="span-class-s2-the-bug-span">The bug</h2>
VRF is a random number generator (RNG) that allows smart contracts to access random values without compromising security.
The product is used by several crypto projects, including Axie Infinity, PancakeSwap, and Aavegotchi, to protect their smart contract with tamper-proof randomness that cannot be manipulated and ensure verifiable outcomes using cryptographic proofs.
Last year, Trust and Obront submitted a report on how a malicious VRF subscription owner could have prevented users from getting this neutral randomness roll by blocking and rerolling randomness until they received a desired value.
According to the Chainlink team, this bug was categorized as a critical-impact smart contract vulnerability, <a href="https://blog.chain.link/smart-contract-research-case-study/#case_study__immunefi_bug_bounty_report" rel="noopener noreferrer nofollow">adding that</a>:
<blockquote>
 “While it could compromise Chainlink VRF’s intended use of providing transparently verifiable tamper-resistant onchain randomness, the exploitable scenario required a number of specific conditions to be met and would be detectable onchain. Most notably, the subscription owner—a role typically controlled by the team behind the dApp using VRF—must be malicious or compromised.”
</blockquote>
Following the incident, Chainlink implemented a security feature to prevent malicious VRF owners from exploiting the issue.
<h2 id="chainlink-enjoying-institutional-interest">Chainlink enjoying institutional interest</h2>
Chainlink’s Cross-Chain Interoperability Protocol (CCIP) technology has seen an increase in adoption from adoption from major traditional institutions.
The global financial messaging network Swift used the technology in a <a href="https://cryptoslate.com/swift-successfully-transfers-tokens-across-blockchains-in-landmark-experiment-with-chainlink/" rel="noopener noreferrer nofollow">tokenization experiment</a> that involved the transfer of tokens across multiple blockchains in August. South Korean gaming giant also <a href="https://cryptoslate.com/south-korean-gaming-titan-wemade-taps-chainlink-for-interoperable-web3-gaming-ecosystem/" rel="noopener noreferrer nofollow">used it to power</a> an interoperable Web3 gaming ecosystem in October.
Also, Hong Kong authorities adopted it for value exchange in its Central Bank Digital Currency (CBDC) trials.
As a result, Chainlink’s native LINK token and Grayscale’s Chainlink Trust (GLNK), an institutional investment vehicle, have seen their <a href="https://cryptoslate.com/grayscale-chainlink-trust-is-trading-200-percent-higher-than-link/" rel="noopener noreferrer nofollow">value surge</a> to new highs.
The post <a href="https://cryptoslate.com/chainlink-vrf-vulnerability-thwarted-by-white-hat-hackers-with-300k-reward/" rel="noopener noreferrer nofollow">Chainlink VRF vulnerability thwarted by white hat hackers with $300K reward</a> appeared first on <a href="https://cryptoslate.com" rel="noopener noreferrer nofollow">CryptoSlate</a>.

Chainlink VRF vulnerability thwarted by white hat hackers with $300K reward

Table of Contents

CryptoSlate

Other articles published on Nov 15, 2023

CBDCs could eventually replace cash, IMF indicates

A First Happened in the Cryptocurrency Market After 17 Months! Taurus Harbinger?

Kazakhstan Embarks on a New Era with the Launch of Digital Tenge

BlackRock Issues Warning: USDT & USDC Stablecoins Put Bitcoin At Risk

Is Lithuania the top Choice Among EU Countries for Acquiring a Cryptocurrency License?

President of Dynamic Securities Analytics delivers testimony on crypto crime at House Subcommitte...

Join our free newsletter for daily crypto updates!