Aurora, a company that provides Ethereum compatibility, NEAR Protocol scalability, and industry-first user experience through affordable transactions, has paid $2 million to two hackers that discovered a vulnerability in its platform.
According to the company, no user’s funds were affected by the EVM scaling and bridge solution. The two hackers were awarded $1 million each in the company’s native cryptocurrency Aurora.
The bounties would be paid out in a year’s time by the ImmuneFi bug bounty platform handling the payments.
Halborn, a security company, identified the flaws on June 10 before revealing them on Wednesday, September 29, 2022. Aurora is a Layer 2 scaling solution and EVM-compatible bridge between the Layer 1 NEAR protocol and Ethereum. The initial vulnerability was caused by Aurora’s use of a separate ERC-20 (fungible token standard) known as NEP-141.
The bridge between the two chains is permissionless, which means that anybody may bridge over any token to any address without their knowledge.
An attacker may have produced a worthless NEP-141 token on NEAR, bridged it to Aurora, and then distributed it to unwitting victims. As a result, attackers would be able to “take ETH from Aurora addresses essentially for free,” according to the report. This is due to the bridge’s ability to charge the recipient or victim a fee denominated in ETH.
The second vulnerability was related to the bridge’s burning feature. Tokens are burnt on one chain and debited on the other when users bridge funds from one network to another.
An assailant may have staged a “fake burn event” without it really happening. This bogus event might then be used to take funds from the Ethereum locker, which is the Aurora bridge’s stored amount of ETH utilized for chain bridging.