Ethereum

Blast

Security

Gold

Blast, the new Ethereum Layer 2 solution, has some security concerns, according to a research <a href="https://medium.com/@resonance.security/bf4adffebc33" rel="nofollow noopener" target="_blank">report</a> by cybersecurity company <a href="https://www.resonance.security/" rel="nofollow noopener" target="_blank">Resonance Security</a>. Blast has quickly gained traction in the crypto industry. It promises points, airdrops, jackpots, native staking yields, and gas revenue sharing. But Resonance says Blast should improve its security measures. 
From its announcement to its launch, Blast accepted ETH deposits through a one-way bridge. This allowed users to accumulate native yield and Blast Points, promising early adopters entry into a future airdrop.&nbsp; 
<figure style="width: 100%" class="wp-caption alignnone">
 <img loading="lazy" decoding="async" src="https://miro.medium.com/v2/resize:fit:1400/0*E01WPbrxVjSpBGTS" alt="Alarming security flaws exposed in Ethereum L2 solution Blast" width="1400" height="752">
 <figcaption class="wp-caption-text">
 Source: <a href="https://l2beat.com/scaling/projects/blast#" rel="nofollow noopener" target="_blank">L2Beat</a>
 </figcaption>
</figure> 
Despite criticism from major financial backers like Paradigm, this strategy boosted Blast’s popularity. It attracted $600 million in its first week, reaching over $1 billion by January 2024. As of now, Blast’s total value locked (TVL) stands at $3.16 billion, making it the fourth-largest EVM L2. 
Users can deposit ETH onto Blast in exchange for liquid L2 tokens. The deposited ETH is staked in Lido staking pools via Blast smart contracts, earning a 4% interest rate.&nbsp; 
For stablecoins, users bridge them to Blast for USDB, Blast’s official stablecoin, which generates yield through MakerDAO’s T-bill protocol with a 5% interest rate. USDB can be redeemed for DAI when bridged back to Ethereum. 
Blast Gold is awarded to dApps built on the chain, rewarding them for using Blast-native features, and is distributed manually every 2-3 weeks or during jackpot events. 
<h2 id="blast-inherits-security-concerns">Blast inherits security concerns</h2> 
According to Resonance, Blast’s reliance on third-party DeFi protocols like Lido and MakerDAO introduces potential risks. If any yield-generating pools or protocols on these platforms are compromised, the associated tokens of Blast users will also be affected. This dependence on Lido and MakerDAO’s security to protect users’ funds could lead to financial issues for Blast users. 
<figure style="width: 100%" class="wp-caption alignnone">
 <img loading="lazy" decoding="async" src="https://miro.medium.com/v2/resize:fit:1400/0*gzIh2TNEwHXKU8hq" alt="Security concerns found in Ethereum L2 solution Blast: Resonance Security" width="1400" height="745">
 <figcaption class="wp-caption-text">
 How Blast’s smart contract works. Source: L2Beat
 </figcaption>
</figure> 
Previously, HTX Square <a href="https://square.htx.com/2023/12/20/decoding-blast-potential-risks-and-controversies/" rel="nofollow noopener" target="_blank">pointed out</a> that Blast’s LaunchBridge contract (0x5f…a47d) is not a rollup bridge but a “custodial contract protected by a 3/5 multisig address.” Jarrod Watts of Polygon Labs also raised concerns about these multisig addresses, saying that they are newly created and their owners are unknown.&nbsp; 
<figure id="attachment_547796" aria-describedby="caption-attachment-547796" style="width: 100%" class="wp-caption alignnone">
 <img loading="lazy" decoding="async" class="wp-image-547796 size-full" src="https://www.cryptopolitan.com/wp-content/uploads/2024/06/Screenshot-2024-06-27-at-12.49.02.png" alt="Security concerns found in Ethereum L2 solution Blast: Resonance Security" width="1181" height="572" srcset="https://www.cryptopolitan.com/wp-content/uploads/2024/06/Screenshot-2024-06-27-at-12.49.02.png 1181w, https://www.cryptopolitan.com/wp-content/uploads/2024/06/Screenshot-2024-06-27-at-12.49.02-300x145.png 300w, https://www.cryptopolitan.com/wp-content/uploads/2024/06/Screenshot-2024-06-27-at-12.49.02-768x372.png 768w" sizes="(max-width: 1181px) 100vw, 1181px">
 <figcaption id="caption-attachment-547796" class="wp-caption-text">
 Source: Jarrod Watts
 </figcaption>
</figure> 
CryptoHopper questioned Blast’s claim of being an L2, stating, “Blast lacks the necessary validity proofs for an L2 state root and does not have an anti-fraud mechanism in place.” Resonance thinks Blast’s Risk Summary further corroborate these concerns. 
<figure style="width: 100%" class="wp-caption alignnone">
 <img loading="lazy" decoding="async" src="https://miro.medium.com/v2/resize:fit:1400/0*qRgjO0hldzs6XKjr" alt="Security concerns found in Ethereum L2 solution Blast: Resonance Security" width="1400" height="733">
 <figcaption class="wp-caption-text">
 Source: L2Beat
 </figcaption>
</figure> 
Resonance also looked into Lido and MakerDAO’s security protocols. MakerDAO has not published a <a href="http://security.makerdao.com/audit-reports" rel="nofollow noopener" target="_blank">security audit</a> of their smart contracts in three years, with some audits dating back five years.&nbsp; 
This is concerning because smart contracts can be susceptible to newly discovered vulnerabilities and should be audited periodically. Resonance states that a quick query for smart contract CVEs in the NIST National Vulnerability Database returned 584 records published between 2018 and 2024. While specific contracts may not be susceptible to all these CVEs, they are likely susceptible to some. 
Maintaining smart contract security requires a multi-faceted approach, including pre-deployment and periodic security audits and bug bounty programs. 
<blockquote>
 “Regular communication and joint security testing can also help validate these standards and improve upon them over time.” 
 Resonance Security
</blockquote> 
Smaller projects need to be meticulous when choosing their third-party providers. Proactively vetting third-party options for strict security standards can save projects many headaches in the long run. If third-party options do not meet a project’s required standards, developing in-house solutions might be a safer alternative. As long as the project has the resources to do so.&nbsp; 
This allows for complete control over the security. Forming partnerships or alliances with other projects can help collectively advocate for better security practices with larger third-party providers. A united front will have more influence than individual efforts, said Resonance. 
Jai Hamid

Security concerns found in Ethereum L2 solution Blast: Resonance Security

Table of Contents

Cryptopolitan_News

Другие статьи, опубликованные 27 июн. 2024 г.

5 Best Risk/Reward Meme Coins For 5X Profit In July

Copper and Sui’s Strategic Alliance to Redefine Financial Blockchain Infrastructure

Make Haste and Join Qubetics Whitelist as Tron and Polygon are About to Deter With Major Declines

Reuters Announces Date for Ethereum Spot ETFs to Start Trading

MicroStrategy Launches AI-Driven Data Insights for Enterprise Apps

Bitcoin’s Oversold RSI Triggers Analyst Predictions of 60%+ Rally

Join our free newsletter for daily crypto updates!