English
Arabic
Chinese (Simplified)
Indonesian
Russian
Ethereum layer-2 community Scroll has delayed its chain finalization on account of a doubtlessly exploitable bug inside its ecosystem.
On July 19, Rho Markets, a lending protocol on the blockchain, detected uncommon exercise and suspended operations to research.
Blockchain safety agency Cyvers Alert reported a hack of roughly $7.6 million on Rho Markets’ USDC and USDT swimming pools. The agency said:
“The basis reason behind this incident appears to be an oracle entry management by a malicious actor!”
Based on DeBank’s dashboard, the exploiter’s pockets holds 2,203 ETH value $7.5 million and different property like Mantle’s MNT, Binance’s BNB, and Fantom’s FTM tokens.
In response, Scroll Community said that it was delaying its chain finalization. The challenge said:
“After verifying with the Rho Markets crew, we initiated a coordinated response. To completely assess the state of affairs, Scroll determined to briefly delay chain finalization. We confirmed that the exploit was application-specific.”
In the meantime, Scroll’s choice sparked a debate in regards to the community’s decentralization. Critics argue that delaying the chain contradicts decentralized ideas, whereas supporters imagine the transfer was essential to guard customers’ property.
Andy, the co-founder of The Rollup, said:
“Till issues are near being maximally decentralized I feel pausing state finalization to forestall consumer funds being misplaced is correct. Particularly an ecosystem challenge who’s making an attempt to innovate. I don’t know what this says about Scroll’s censorship resistance although.”
Whitehat hacker?
In the meantime, the attacker seems prepared to return the stolen funds, resulting in speculations that the incident is perhaps a whitehat act.
On-chain messages shared by blockchain investigator ZachXBT present the attacker’s willingness to return the funds. The message reads:
“Good day RHO crew, our MEV bot profited out of your worth oracle misconfiguration. We perceive the funds belong to customers and are prepared to completely return them. However first, we want you to confess it was a misconfiguration, not an exploit or hack. Additionally, please clarify how you’ll forestall this from taking place once more.”
Notably, on-chain knowledge exhibits the attacker’s tackle is linked to a number of centralized crypto exchanges, together with Binance, Gate, KuCoin, and OKX.