Polygon Fixes Bug that Could Have Put $24B Worth MATIC at Risk
Polygon Prevents a Major MATIC Hack
Polygon reported a problem in a "critical" vulnerability in its proof-of-stake genesis contract. The bug was eventually resolved at Block #22156660 via an Emergency Bor Upgrade to the Mainnet on Dec. 5 at around 7:27 am UTC.
Had it remained unfixed, attackers could have easily stolen over 9.2 billion MATIC tokens, worth over $24 billion, at the time of writing. While the total supply of MATIC is 10 billion, this means almost all of the tokens were at risk.
Before the critical bug on the network was fixed via hardfork, on Dec. 5 an unknown hacker, however, managed to steal 801,601 MATIC worth $2.04 million at today's price.
The vulnerability was first reported on the bug bounty platform Immunefi via two white hat hackers “Leon Spacewalker” and “Whitehat2,” respectively. “Leon Spacewalker” being the first to report on Dec. 3 will get a reward of $2.2 million worth of stablecoins while “Whitehat2” will receive 500,000 MATIC ($1.27 million) from Polygon.
Commenting on the development, Polygon’s co-founder Jaynti Kanani said:
“All projects that achieve any measure of success sooner or later find themselves in this situation. What’s important is that this was a test of our network’s resilience as well as our ability to act decisively under pressure. Considering how much was at stake, I believe our team has made the best decisions possible given the circumstances.”
In its recent blog post, Polygon clarified that the issue was quietly resolved as it follows the “silent patches” policy introduced by the Go Ethereum team last year. Under the guidelines, projects report key bug fixes 4-8 weeks after they go live to avoid the risk of being exploited at the time of patching.