Critical vulnerability found in Ethereum 2.0 staking protocols
Dmitri Tsumak, co-founder of the Ethereum 2.0 Stake Wise staking service, discovered a vulnerability in the competing Rocket Pool and Lido protocols that could lead to the theft of user funds.
1/ Last night around 7PM UTC, our founder Dmitri Tsumak (@tsudmi) discovered a severe vulnerability in @Rocket_Pool that could lead to the theft of users’ funds if exploited.— StakeWise (@stakewise_io) October 5, 2021
Upon further examination, it became apparent that @LidoFinance's architecture was also affected. https://t.co/xlpZMYkFMe
The developer refrained from publicly disclosing the details of the bug. Rocket Pool and Lido Finance have confirmed the information.
Rocket Pool postponed the launch to mainnet scheduled for October 6.
1/ Yesterday our bug bounty program helped discover an exploit that also affected other staking providers, as a result we are postponing launch to implement a fix.— Rocket Pool (@Rocket_Pool) October 5, 2021
We would like to extend our warmest thanks to @tsudmi for raising the exploit.
The project has also assigned a bug bounty program ($100,000) in the Immunefi service.
According to Lido Finance, about 20,000 ETH (~ $ 71.5 million) were at risk.
Here's an update on the response to the vulnerability reported yesterday:https://t.co/12xIHwexxD— Lido (@LidoFinance) October 6, 2021
We want to thank Dmitri Tsumak (@tsudmi) for discovering and reporting the exploit, as well as @immunefi, @stakewise_io, and @Rocket_Pool teams for validating and escalating it.
The Rocket Pool team announced that it will begin testing the proposed proof of concept fix next week. The developers "are in close communication" with the auditors from Sigma Prime that will confirm the fix from October 18th.
Internal testing of our proof of concept fix for the raised exploit will begin next week. We have been in close communication with our auditors @sigp_io who will be confirming the fix from 18th Oct.— Rocket Pool (@Rocket_Pool) October 8, 2021
We will make sure our awesome community are kept up to date as things develop.