Optimism Foundation has confirmed that 20M OP tokens were sent to an incorrect multisig wallet, even though they had completed two tests.

The Optimism Foundation issued a statement confirming the incorrect address for 20M OP tokens intended for a liquidity provisioning partnership Wintermute.

It took place May 26, 2012. The community was only recently informed. The incident caused a sharp drop in the value of OP tokens. CoinGecko reports that it dropped 31.2% to $0.76 during the previous 24 hours.

The Event

Officially, the Optimism Foundation team explains how they hired Wintermute to supply liquidity provisioning services as part of preparations for the OP coin launch. A temporary grant of 20 million OP tokens was allocated to Wintermute from the Foundation’s Partner Fund to carry out this engagement. The total amount of tokens was delivered by the Optimism group after Wintermute verified two tests.

Wintermute discovered that the tokens could not be accessed because Wintermute had given an address for a (L1) multisig they hadn’t yet deployed to Optimism. The contract was then open to attack by a malicious actor who took over the L2 contract.

When the problem became apparent, the Wintermute team “began a recovery operation intending to deploy the L1 multi-sig contract to the same address on L2.” Still, the attempts to fix the situation were too late.

“An attacker was able to deploy the multi-sig to L2 with different initialization parameters before the recovery operation was completed and took control of the 20 million OP tokens. This address has since sold 1 million tokens and can easily sell the rest.”

An attacker managed to install the multisig L2 to different initialization parameters, thereby assuming control of the 20m OP.

This address has since sold 1m OP:https://t.co/W8uiYPB9Of

— Optimism (_) (@optimismPBC) June 8, 2022

Optimism is known as a Layer 2 scaling solution for Ethereum that can support all of Ethereum’s Dapps. Instead of operating all computations and data on Ethereum’s network, Optimism places all transaction data onto the Ethereum chain. It runs computation off-chain, increasing Ethereum’s transactions per second and decreasing transaction fees. Optimism tokens can only be purchased using OP tokens.

Aftermath

In response to the Optimism community, Wintermute acknowledged making “a serious mistake” and took full responsibility for the exploit. The firm stated that it would perform OP buybacks equal to the amount the exploiter sells to make “best efforts to smoothen the effects” of price volatility.

Wintermute spoke to the hacker in the statement and offered to consider the incident a white hat attack if he returned 19 million tokens within a week.

“We are 100% committed to returning all the funds, tracking the person(s) responsible for the exploit, fully doxxing them, and delivering them to the corresponding juridical system. Robbers must be lucky all the time. Cops only have to get lucky once,” wrote Wintermute.

Replies to Wintermute’s message mostly applauded the firm for its transparency in revealing the issue and accepting the blame for what happened. But not everyone in the crypto community supports this approach. Bear Baron Hellspawn posted about the amateurish or inside approach.

I think it looks like amateur time from @wintermute_t

Either amateur hour by so called “liquidity provider”

Both inside and outside jobs. Because unless you do some voodoo sh*t you cannot assume that $OP tokens will be transfered at a very SPECIFIC address.

— Bear Baron Hellspawn (@hellspawncrypto) June 8, 2022

Chris Blec (host of Proof of Decentralization Podcast) tweeted that he thought the best explanation was that Wintermute might have been involved in the attack.

Is $20m enough of an incentive for someone at Wintermute to run this “attack” on themselves?

Why is it that everyone involved in the space seems so opposed to reviewing all possible options?

Are you afraid to hurt someone’s feelings?

The first is logic. Feelings come after logic. https://t.co/EQnrfGJWiF

— Chris Blec (@ChrisBlec) June 8, 2022

Continue reading on DailyCoin