Andrew Thurman

Over $70 million in various digital assets have been hacked in a series of attacks on the Curve Finance decentralized exchange on Sunday.&nbsp;



The attacks began at roughly 9:30 am ET, beginning with an exploit of JPEG’d’s pETH-ETH liquidity pool for over $11 million, although that may have been <a href="https://twitter.com/DecurityHQ/status/1685646377198505985">frontrun</a> by an <a href="https://twitter.com/DecurityHQ/status/1685646377198505985" target="_blank" rel="noreferrer noopener">MEV searcher</a>. 



Four other attacks — potentially all launched by different <a href="https://app.cielo.finance/feed/preview/3971-Vyper-Reentrancy-Hackers?minUSD=1000">actors</a> — also drained Alchemix’s alETH-ETH pool, the CRV/ETH pool twice, Pendle’s pETH-ETH pool, and Metronome’s msETH-ETH pool, for a total of over $70 million, per security expert <a href="https://twitter.com/tayvano_/status/1685789453556846592/photo/1" target="_blank" rel="noreferrer noopener">analysis</a>. Some of the hacks were reportedly executed by whitehat hackers, meaning that the total amount lost could be closer to $50 million. 



In a statement on the Curve Discord, team representative “mimaklas” wrote at roughly 4:30 pm ET that &#8220;all affected pools have been drained or white hacked. All remaining pools are safe and unaffected by the bug.&#8221; A Curve representative declined to comment.&nbsp;



Despite these public statements, the attacks may still be ongoing. Two hours after mimaklas’ message, another exploit of the CRV-ETH pool drained an <a href="https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052" target="_blank" rel="noreferrer noopener">additional</a> $5.2 million. 



With $3 billion in liquidity, Curve is comfortably the second-largest and most structurally significant DEX in DeFi, and carries particular importance for stablecoin swap markets — which were not impacted. Curve’s <a href="https://blockworks.co/price/crv" target="_blank" rel="noreferrer noopener">CRV</a> governance and rewards token is down 13.4% to $0.64 after falling as low as $0.58 earlier in the day.  



<h2 class="wp-block-heading">0-day bug</h2>



According to Dr. Laurence Day, the founder of Wildcat Finance and a frequent presenter on smart contract exploits, the thefts were enabled by a zero-day vulnerability in particular versions of the compiler for Vyper, the programming language Curve used for multiple contracts.&nbsp;



The vulnerability is rooted in an assumption regarding “reentrancy” preventions that failed to work as intended. Reentrancy attacks are <a href="https://blockworks.co/news/the-nine-largest-crypto-hacks-in-2022">a common exploit vector</a>.



In the hours since the vulnerability came to light, there has been some amount of finger-pointing between development teams. In a since-deleted tweet, the official Curve Twitter account seemed to blame JPEG’d developers for the exploit. JPEG’d’s team in turn <a href="https://twitter.com/JPEGd_69/status/1685700962621464576" target="_blank" rel="noreferrer noopener">defended</a> themselves.



Curve is also an important <a href="https://gov.curve.fi/t/proposal-to-fund-vyper-development-via-a-new-fundraising-gauge/2726" target="_blank" rel="noreferrer noopener">supporter</a> of the Vyper team, having funded its ongoing development in the past, and Curve team members are actively involved in the maintenance of the Vyper codebase. 



Day cautioned against blaming any one team for the exploit.&nbsp;



“Compilers come pre-packed with a whole host of behavioural assumptions that the vast majority of us simply take for granted because we assume that people smarter than us have done the leg-work closer to assembly,” he wrote. “It&#8217;s very easy to point fingers and call out failures to verify these things.”



<h2 class="wp-block-heading">Alchemix halts contracts</h2>



Among the hardest-hit protocols in the attack, Alchemix has paused a number of contracts to prevent the exploiter from swapping alETH for native ETH, including a bridge to Optimism where the AMM Velodrome has $4.4 million in liquidity in an alETH pool, and the “transmuter” contract, which exchanges alETH for ETH 1-to-1.



Alchemix is designed to give users an advance on their future yield, and uses a synthetic ether derivative, alETH, backed by ether in the process.&nbsp;



Nonetheless, in a <a href="https://twitter.com/AlchemixFi/status/1685737642565173248" target="_blank" rel="noreferrer noopener">tweet</a> the Alchemix development team reports that an exploiter managed to take 5,000 ETH from the alETH-ETH pool, possibly leaving the alETH asset partially unbacked. The extent of the damage is unclear; two attacks on the alETH drained over $30 million, but one may have been a whitehat operation. 



Additionally, one <a href="https://debank.com/profile/0xb8b92767f681979fc1c1af75014adb51e4e4958b" target="_blank" rel="noreferrer noopener">user</a> who appears to be unassociated with the initial exploits took advantage of the exploit to swap 5 ETH for 1200 alETH, which they subsequently transferred to a secondary address prior to <a href="https://debank.com/profile/0x60ee0c8bb493b79286a54997322904f74fba3736/history" target="_blank" rel="noreferrer noopener">selling</a>.



alETH is currently trading for $1,476 relative to native ETH at $1,887, meaning the market is assuming a 22% lack of backing. alETH has $68 million in total market capitalization per Coingecko, with $38 million on Ethereum mainnet alone.



Alchemix’s governance token <a href="https://blockworks.co/price/alcx" target="_blank" rel="noreferrer noopener">ALCX</a> fell about 7% after the exploit.



<h2 class="wp-block-heading">Possible contagion</h2>



Aside from the economic damage from the attacks themselves — the pools that were exploited were significantly larger in dollar terms at the time of attack than what the exploiters actually managed to swipe — many observers are worrying over the potential ripple effects.&nbsp;



Of particular interest is Curve Finance founder Michael Egorov’s $60 million Aave V2 loan. The loan is backed primarily with CRV tokens far in excess of what the protocol could easily liquidate, which <a href="https://blockworks.co/news/aave-curve-bad-debt">could potentially result in bad debt</a>.&nbsp;



The size of Egorov’s position is such that it has perhaps <a href="https://blockworks.co/news/curve-stablecoin-crv-loan">previously been the target of attack</a>.&nbsp;



After Egorov’s account added collateral to the protocol and paid down nearly $4 million in debt, the position is currently stable.&nbsp;



<h2 class="wp-block-heading">Potential recovery</h2>



A portion of the hacked funds not seized by whitehats have also already proved to be recoverable.&nbsp;



Three of the five exploits were frontrun by MEV searchers, including the <a href="https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c" target="_blank" rel="noreferrer noopener">attack</a> on the pETH-ETH pool, the msETH-ETH pool, and the second attack on the CRV-ETH pool. 



In the case of the latter two, the exploits were frontrun by prolific MEV account <a href="https://etherscan.io/address/0xc0ffeebabe5d496b2dde509f9fa189c25cf29671" target="_blank" rel="noreferrer noopener">coffeebabe.eth</a>. This address previously <a href="https://etherscan.io/tx/0x7c68304cd55a36ee61fb4ca1f10fca5d2a0d6bf0103f28d61345fb33c6c8c61c" target="_blank" rel="noreferrer noopener">attempted</a> to communicate with Sushi to return funds after frontrunning another exploit months ago. 



Their address remained active throughout the ordeal, executing trades on popular memecoins in addition to frontrunning the attacks, implying that the frontruns might have occurred autonomously by the account without active knowledge on the part of the account owner.&nbsp;



Curve <a href="https://etherscan.io/tx/0x65670d8e4f08d56971d476b0c68ca745b0749ec7f79f9b79d993ef47cc91b9c6">communicated</a> on-chain with Coffeebabe.eth who expressed intent to move exploited funds to cold storage, as well as their wish to return funds to affected parties.


<div class="wp-block-image">
<figure class="aligncenter size-large"><img loading="lazy" decoding="async" width="1956" height="470" src="https://blockworks-co.imgix.net/wp-content/uploads/2023/07/Screenshot-2023-07-31.jpg?w=1024&amp;h=1024" alt="" class="wp-image-63333" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2023/07/Screenshot-2023-07-31.jpg?w=1956 1956w, https://blockworks-co.imgix.net/wp-content/uploads/2023/07/Screenshot-2023-07-31.jpg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2023/07/Screenshot-2023-07-31.jpg?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2023/07/Screenshot-2023-07-31.jpg?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2023/07/Screenshot-2023-07-31.jpg?w=1536 1536w, https://blockworks-co.imgix.net/wp-content/uploads/2023/07/Screenshot-2023-07-31.jpg?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2023/07/Screenshot-2023-07-31.jpg?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2023/07/Screenshot-2023-07-31.jpg?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2023/07/Screenshot-2023-07-31.jpg?w=80 80w" sizes="auto, (max-width: 1956px) 100vw, 1956px" /><figcaption class="wp-element-caption">Message embedded in on-chain transaction</figcaption></figure></div>


As of roughly 8:00 pm ET coffeebabe.eth <a href="https://etherscan.io/tx/0xb76754124fdde090f25129105ed2907e3c62e0db87ecb8ffcefcb1dede0954fd" target="_blank" rel="noreferrer noopener">returned</a> the funds from the second CRV/ETH pool exploit.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Curve suffers $70M exploit, but damage contained

Ornella Hernandez

<div id="highlights-block_632a1ef741545" class="highlights">
 <ul>
 <li>Arbitrum paid 400 ETH via ImmuneFi to white hat hacker</li>
 <li>Arbitrum bridge bug was caused by bad initializers in the contract code</li>
 </ul>
 
</div>



Another cryptocurrency vulnerability has been uncovered by a so-called white hat hacker, who found an exploitable bug in the bridge between Ethereum and Arbitrum Nitro.



The hacker, known as riptide on Twitter, outlined their <a href="https://medium.com/@0xriptide/hackers-in-arbitrums-inbox-ca23272641a2" target="_blank" rel="noreferrer noopener">discovery</a>, which comes on the heels of an escalating series of hacks in the bridges that connect different blockchains, which collectively have been drained of hundreds of millions of dollars of predominantly user funds this year. 



Arbitrum, the layer-2 Ethereum scaling solution, paid riptide a bounty of 400 ether (ETH) as a reward via the bug bounty platform ImmuneFi.



The multi-million dollar vulnerability, as riptide called it, would have allowed an attacker to steal all incoming ether deposits from users attempting to bridge their assets between Ethereum layer-1 and layer-2 protocols to Arbitrum.



The initialization-related vulnerability, according to the white hat hacker, would have enabled any nefarious actor to impersonate a user and send the authentication message to the “sequencerInbox” function to execute the vulnerability.&nbsp;



The largest deposit recorded on the inbox contract was 168,000 ETH, around $250 million, with average deposits ranging from 1,000 to 5,000 ETH in a 24-hour period, riptide said.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">No big deal just bridging a cool $470mm through the same Inbox contract 👀 Definitely should be eligible for a max bounty 🤯 <a href="https://t.co/w7S58QNQZu">https://t.co/w7S58QNQZu</a>&mdash; riptide (@0xriptide) <a href="https://twitter.com/0xriptide/status/1572215767029977094?ref_src=twsrc%5Etfw">September 20, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Another Twitter user, smartcontracts.eth, <a href="https://twitter.com/kelvinfichter/status/1572213465854386178?s=20&amp;t=pb8MA3trIOvmUEpQImfGQQ" target="_blank" rel="noreferrer noopener">commented</a> that “rollups are still heavily in development,” cautioning his followers to be careful on layer-2 protocols. A layer-2 refers to a mechanism built on top of a blockchain’s core layer, typically to increase scalability or speed, plus introduce additional features. 



A similar bug was seen in the token bridge <a href="https://cms.blockworks.co/nomad-token-bridge-raided-for-190m-in-frenzied-free-for-all/" target="_blank" rel="noreferrer noopener">Nomad’s smart contract, which cost the protocol  $190 million in cryptocurrency</a> in the third-biggest cryptocurrency hack of the year.



Arbitrum <a href="https://cms.blockworks.co/arbitrum-upgrades-to-nitro-ahead-of-ethereum-merge/" target="_blank" rel="noreferrer noopener">recently launched Nitro</a> exactly one year after the rollup’s now-defunct first iteration and ahead of <a href="https://cms.blockworks.co/cryptos-equities-slide-on-central-bank-decisions-merge-aftermath/" target="_blank" rel="noreferrer noopener">the Merge</a>.



<h3 class="wp-block-heading">Arbitrum NFTs</h3>



Additionally, Arbitrum plans to integrate with NFT marketplace OpenSea on Wednesday.&nbsp;



A slew of NFT collections built on Arbitrum will be available to buy and sell directly on OpenSea.



OpenSea tweeted that creators would need to find their collections and set their creator fees directly.&nbsp;



The marketplace recently added the royalties percentages front-and-center on a collection’s page.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">1/ We’re excited to share that OpenSea will soon support <a href="https://twitter.com/arbitrum?ref_src=twsrc%5Etfw">@arbitrum</a>! 💙🚀 This is a first step in building our goal of a web3 future where people have access to the NFTs they want on the chains they prefer.&mdash; OpenSea (@opensea) <a href="https://twitter.com/opensea/status/1572250900198203392?ref_src=twsrc%5Etfw">September 20, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Arbitrum

Arbitrum Saved From Major ETH Loss by White Hat Hacker

<div id="highlights-block_62ec4dc44dae4" class="highlights">
 <ul>
 <li>Nomad is considering a 10% bounty for hackers who return most of their stolen funds</li>
 <li>The largest return to date has been 100 ETH ($160,000)</li>
 </ul>
 
</div>



Token bridge <a href="https://cms.blockworks.co/nomad-token-bridge-raided-for-190m-in-frenzied-free-for-all/" target="_blank" rel="noreferrer noopener">Nomad suffered a hack</a> on Monday that resulted in a loss of $190 million in cryptocurrencies. So far, $19.4 million of those funds have been sent <a href="https://etherscan.io/address/0x94A84433101A10aEda762968f6995c574D1bF154" target="_blank" rel="noreferrer noopener">back</a> to the protocol.



Nomad <a href="https://twitter.com/nomadxyz_/status/1554679735006859264?s=20&amp;t=-HOi7igUyKVFpMpTgHB0wg" target="_blank" rel="noreferrer noopener">created a recovery wallet address</a> in a plea to the “white hat hackers and ethical researcher friends who have been safeguarding ETH/ERC-20 tokens” to return the lost digital assets.



The wallet was set up in association with custodian bank Anchorage Digital. Nomad has since taken to Twitter to thank some of its contributors.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Thank you to &#8211; 🍉🍉🍉.eth ($4m) &#8211; 0xE3F40743cc18fd45D475fAe149ce3ECC40aF68c3 ($3.4m) &#8211; darkfi.eth ($1.9m) &#8211; returner-of-beans.eth ($1m) &#8211; anime.eth ($900k) for returning a total of $11.2m to our recovery address! We’ve recovered a total of $16.6m so far.&mdash; Nomad (⤭⛓🏛) (@nomadxyz_) <a href="https://twitter.com/nomadxyz_/status/1555045760588140544?ref_src=twsrc%5Etfw">August 4, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Nomad’s hack <a href="https://cms.blockworks.co/after-latest-crypto-bridge-hack-industry-participants-call-for-tightened-security/" target="_blank" rel="noreferrer noopener">resulted</a> from an issue in the code itself, 1KX Research told Blockworks. Nomad developers had accidentally enabled a code setting which automatically verified any transaction script sent to the protocol, as long as they had a default “root” of “0x00.”



The result was a free-for-all involving onlookers rushing to submit illicit transactions, quickly draining the token bridge of all user funds kept inside its associated smart contract.



Nomad has <a href="https://twitter.com/nomadxyz_/status/1555191925841563648?s=20&amp;t=-HOi7igUyKVFpMpTgHB0wg" target="_blank" rel="noreferrer noopener">acknowledged</a> that some users wanted “more consistent communications” and apologized for not having “provided that up to this point.”



The firm <a href="https://twitter.com/nomadxyz_/status/1555293965049630722?s=20&amp;t=-HOi7igUyKVFpMpTgHB0wg" target="_blank" rel="noreferrer noopener">announced</a> via Twitter that hackers who return at least 90% of the total funds they hacked may be considered for a bounty of up to 10%. 



This incident is the <a href="https://cms.blockworks.co/the-nine-largest-crypto-hacks-in-2022/" target="_blank" rel="noreferrer noopener">third-biggest cryptocurrency hack this year</a> after the Solana-to-Ethereum <a href="https://cms.blockworks.co/in-second-largest-defi-hack-ever-blockchain-bridge-loses-320m-ether/" target="_blank" rel="noreferrer noopener">Wormhole bridge</a> and the <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">Axie Infinity Ronin bridge exploits</a>, which lost $325 million and $625 million, respectively, valued at the time of the exploits.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

hack

Nomad Recovers Nearly $20M of Stolen $190M

Sebastian Sinclair

<div id="highlights-block_62ce137fc3889" class="highlights">
 <ul>
 <li>DeFi hacks totaled more than $1.2 billion for the first quarter of this year alone, significantly more than Q1 2021, according to recent data</li>
 <li>While the DeFi sector&#8217;s security appears bleak, Immunefi&#8217;s CEO told Blockworks the situation was improving</li>
 </ul>
 
</div>



Hacks against decentralized finance protocols have increased almost eightfold when compared to the first quarter of last year, according to DeFi bug bounty platform Immunefi.



In Q1 of this year alone, over $1.22 billion has been identified as having been stolen or rugged from budding protocols. That&#8217;s a 7.9 times increase when compared to some $154.6 million in stolen funds for the same period in 2021, research from Immunefi&#8217;s quarterly <a href="https://assets.ctfassets.net/t3wqy70tc3bv/50AVQU4PoO8DORKFpbFZMi/4dc973e6d273f78b6ea0b8663f2b9645/Immunefi_Crypto_Losses_-_Q1_2022.pdf" target="_blank" rel="noreferrer noopener">crypto losses report</a> shows.



More than 77% of the $1.22 billion figure stems from the <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">Ronin Network&#8217;s</a> $625 million hack — the Ethereum-linked sidechain used for blockchain game <a href="https://cms.blockworks.co/tag/axie-infinity/" target="_blank" rel="noreferrer noopener">Axie Infinity</a> — in March and blockchain bridge <a href="https://cms.blockworks.co/in-second-largest-defi-hack-ever-blockchain-bridge-loses-320m-ether/#:~:text=Wormhole%2C%20one%20of%20the%20largest,in%20a%20tweet%20Wednesday%20evening." target="_blank" rel="noreferrer noopener">Wormhole&#8217;s</a> $326 million hack in February.



The numbers might look bad on the surface, but Immunefi said it&#8217;s not as bad as it seems.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">&#8220;The most important thing to keep in mind is that although things look bad, they are in fact getting better and better on the security side,&#8221; Immunefi&#8217;s CEO Mitchell Amador told Blockworks in an interview.</blockquote>



&#8220;Audits have become a stronger standard, every DeFi project is getting audits. You&#8217;re having formal character verification becoming the biggest standard. Almost everybody is running bug bounty programs,&#8221; Amador said.



The second quarter this year has seen less-severe hacks against protocols. Amador said the $100 million theft on Harmony&#8217;s cross-chain bridge <a href="https://cms.blockworks.co/defi-cross-chain-horizon-bridge-hacked-for-100m/" target="_blank" rel="noreferrer noopener">Horizon</a> and algorithmic stablecoin protocol <a href="https://cms.blockworks.co/algo-stablecoin-protocol-beanstalk-cut-down-by-governance-hijack/" target="_blank" rel="noreferrer noopener">Beanstalk&#8217;s</a> $180 million loss were outliers.



&#8220;We didn&#8217;t see any kind of dramatic event,&#8221; Amador said comparing to the ongoing liquidity crisis, lender contagion and sector-related layoffs impacting the wider industry. 



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">&#8220;There were some close calls in things that could have happened. Bug reports that came through on consensus vulnerabilities that we saw on layer-1 blockchains but these were all successfully patched,&#8221; Amador added.</blockquote>



Despite the progress, though, the threat is not diminishing.



&#8220;This [continuous hacks] is fundamentally an unsolvable problem,&#8221; the Immunefi CEO said. &#8220;We knew things were going to go in this direction. The volatility is a part of crypto, the amount of money flowing in was going to increase. The number of people with the skills was going to increase, it needs an outlet.&#8221;



Compared to global trends, even a couple of billion dollars is a drop in the proverbial bucket, however. 



Recent <a href="https://onfido.com/resources/blog/what-s-the-true-cost-of-fraud-5-must-knows-for-anti-fraud-strategies" target="_blank" rel="noreferrer noopener">estimates</a> of global losses solely from payment fraud are around $32.4 billion. The global market for fraud detection and prevention is <a href="https://www.researchandmarkets.com/reports/4804869/fraud-detection-and-prevention-global-market" target="_blank" rel="noreferrer noopener">in the order of</a> $25 billion this year — not the fraud itself, but just trying to stop it.



Cybercrime as a whole will <a href="https://cybersecurityventures.com/hackerpocalypse-cybercrime-report-2016/" target="_blank" rel="noreferrer noopener">cost the world</a> around $6.9 trillion in 2022, according to consultant Cybersecurity Ventures. So even if DeFi exploits net $3.5 billion by year&#8217;s end, it would represent 0.05% of the global cybercrime haul.



<h3 class="wp-block-heading">Guard duty</h3>



Immunefi, which views its business and function as a type of human immune system battling viruses, has grown to become the sector&#8217;s largest bug bounty platform, offering rewards to white hat hackers who identify vulnerable code.



Whitehats, as opposed to blackhats, attempt to identify security vulnerabilities for a given project and collect a reward for bringing it to attention. Black hats, meanwhile, are those with nefarious intent, often engaging in theft.



Immunefi&#8217;s bug bounty program offers white hats a chance to accept a reward — upwards of millions of dollars — review the code for potential bugs within a scope, submit their findings and get paid.



The platform, less than two years old, says it safeguards platforms housing cryptoassets worth more than $100 billion, including from the likes of Polygon, Chainlink and SushiSwap, among <a href="https://immunefi.com/" target="_blank" rel="noreferrer noopener">others</a>.



When asked about the possibility of missed bugs and vulnerabilities resulting from a narrow scope within a bug bounty contract, Amador said the only way to deal with the issue was to broaden the bounty program as much as possible.



&#8220;You can&#8217;t totally get rid of [missed bugs] but you can partially get rid of that by looking at prioritizing impact, rather than out of scope or in scope,&#8221; he said. &#8220;The real thing most of these projects care about is material impact.&#8221;



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>