Blog
Creating a safe Web3 is like building a super strong castle, with each digital brick adding to the decentralized structure and keeping it safe from cyber attacks. At this point in our journey, we know there are inherent risks in Web3 and smart contracts, namely human error, Solidity, human error, hackers and their potential to cost millions.
A flaw in Euler's "donateToReserves" function was exploited by a hacker who used flash loans and a leverage system. This led to an undervalued position and the creation of uncollectible debt. The issue was caused by a faulty donation mechanism that did not accurately track debt, allowing the attacker to walk away with $200 million in illicit gains. It can be compared to discovering a loophole in a video game that allows one to win unfairly by spamming the move.
Euler's current total value locked (TVL) is slightly above $63k.
Solutions are many and varied; crypto projects can implement bug bounty programs, encouraging ethical hackers to uncover vulnerabilities before malicious actors exploit them, often in conjunction with frequent audits.
Web3 bug bounties are about finding security flaws in Web3 technology and are like a treasure hunt for tech detectives. Ethical hackers explore the digital frontier to uncover and fix vulnerabilities, earning rewards for their efforts.
Picture yourself as a diligent security researcher examining protocols for potential vulnerabilities. During your investigation, you uncover an overlooked vulnerability. After promptly reporting this issue, you earn a generous $1.8 million bounty for your efforts. By taking action, you have contributed to millions of users' safety. This scenario is not purely hypothetical - the NEAR protocol recently rewarded two individuals for their efforts in this exact manner.
Aurora recently rewarded a whitehat hacker, pwning.eth, with a $6 million bug bounty for identifying a vulnerability that could have potentially risked $200 million of user funds. Pwning.eth discovered a flaw in the Aurora Engine that could have resulted in an inflation risk, allowing for the unlimited minting of ETH. This artificial ETH could have been utilized to drain the bridge contract, containing over 70k ETH during the time of the report.
While it may sound repetitive, it is important to note that offering bounties is ultimately less costly than dealing with a security breach.
The Web3 Bug Bounty program has three stages: security assessment, reporting, and reward distribution. Ethical hackers inspect the software's code, infrastructure, and user interface to identify possible issues. If a problem is discovered, the hacker should provide a detailed explanation and a potential way to exploit it. Once the problem is verified and fixed, the ethical hacker receives a bounty, which is determined by the seriousness of the issue.
AuditOne partnered with Aurora and launched a Bug Bounty Platform, which includes an impressive $1 million bounty. While BugBounties is not new, our platform is unique because it combines our audits and coverage into one product. We commit a percentage of audited revenue for long-term security alignment, which shows "skin in the game." Our dedication to community-driven security is a significant step, and we're excited to start this journey with Aurora. Only selected projects have access to our new product, but we plan to make it permission-less once it has been battle-tested. Auditors interested in this should understand the scope of the program and rules and should know how to report vulnerabilities responsibly and effectively. To learn more about our bug bounty program, visit auditone.io/bug-bounty. Let's work together to ensure the security of our digital future. This is only the start.
Audits: An Important Security Measure, But Not the Only One
Even if the code is perfect in the eyes of the reviewer, a bug bounty may still be necessary to catch potential issues that could come up later. A security audit is generally the first defense against smart contract failure. But with more smart contracts out in the wild interacting with each other, this expands the attack surface. Even though smart contract audits are effective, extra steps are required once the protocol goes live, and bug bounties generally fill this void by being an active, reoccurring defense against the dark arts.
Not all audits are equal, and no one knows how some firms overlook glaring problems that get exploited a day after their audit report is published, rubber stamping it as secure. It could be the auditors or the projects rushing, wanting to go to market faster, and asking to take shortcuts. But with all of that said, delaying a project launch over an audit is better than losing face after a subpar rush audit that didn't come up with any notable vulnerabilities. Yet, you are hacked a week later, and users are outraged.
Advantages
Projects
Auditors
Wrapping up
Web3 bug bounty programs are essential for identifying and fixing issues before they become problems. They improve user trust and offer a line of defense against attacks. These programs distribute rewards publicly, promoting security and collaboration with ethical hackers. To participate, learn blockchain basics, stay updated, study Smart Contract vulnerabilities, and know Solidity.
If you are interested in our bug bounty program, feel free to visit our website at auditone.io/bug-bounty for more information.
.png)
.png)