Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Optimism is an L2 blockchain. The idea is that Ethereum is too slow and too expensive. So, if we rollup a large amount of transactions into a single transaction sent to Etheruem, the gas cost can be shared between them, making it such cheaper.

A sequencer is a program that takes in the proposed transactions and submits them to Ethereum. Of course, lots of proofs and things are done prior to this. In front of the sequencer is a load balancer that rate limits the traffic coming in.

To detect the number of attempts, the rate limiting is calculated based upon the signed transactions per account within a given time window. To prevent censorship, the transactions are discarded if the nonce is lower than the accounts current nonce. Source IP rate limiting is done as well.

Rate limiting is a great feature to prevent network spamming. However, this has logic that can be flawed as well. If developers are not careful then this feature can be used against the system. In this case, the program was not checking the chain id!

So, if the other chain had a nonce that was higher than Optimism, then it was valid for the rate limiting. Down the road, EIP-155 would reject the transaction though. Regardless, it would still trigger the rate limiting functionality. By taking transactions from another chain, a user could be arbitrarily rate limited indefinitely.

Specific accounts in the network have special permissions or are really important other parts of the ecosystem. LayerZero being taken down, censoring of bridges, ProxyAdmin changes and many, many things would be broken. Additionally, this could allow for strange edge cases in the system by choosing when transactions go through and when they don't.

The authors of this request rated this as critical. Considering that any user could prevent any transaction, I understand that. However, this would be identified and fixed within a few days after reviewing the logs of the proxy. The Optimism team decided this was a medium risk finding in the end. Sadly, this was marked as out of scope, which I hate.