{"id":479954,"date":"2021-12-28T12:21:24","date_gmt":"2021-12-28T12:21:24","guid":{"rendered":"https:\/\/uniquehot.com\/?p=479954"},"modified":"2021-12-28T12:45:14","modified_gmt":"2021-12-28T12:45:14","slug":"polygon-s-side-of-the-story-hard-fork-resolved-a-critical-vulnerability","status":"publish","type":"post","link":"https:\/\/uniquehot.com\/news\/polygon-s-side-of-the-story-hard-fork-resolved-a-critical-vulnerability\/","title":{"rendered":"Polygon \u2019s Side Of The Story: Hard-Fork Resolved A \u201cCritical Vulnerability\u201d"},"content":{"rendered":"
The Polygon team promised an explanation and <\/span>here it is<\/span><\/a>. A few weeks ago, the Ethereum Layer 2 network hard-forked their blockchain, seemingly without explanation. As usual, <\/span>NewsBTC got to the bottom of the case<\/span><\/a> and presented all of the available information. The only piece missing was a promised official report from Polygon\u2019s experts. Is this it? Apparently so.\u00a0<\/span><\/p>\n Related Reading | Community Voted, Why Uniswap Will Be Deployed On Polygon<\/a><\/strong><\/em><\/p>\n Before we get into it, let\u2019s remember Polygon\u2019s co-founder Mihailo Bjelic\u2019s explanation as reported by us:\u00a0<\/span><\/p>\n \u201cWe\u2019re making an effort to improve security practices across all Polygon projects,\u201d Bjelic tweeted. \u201cAs a part of this effort, we are working with multiple security researcher groups, whitehat hackers etc. One of these partners discovered a vulnerability in one of the recently verified contracts. We immediately introduced a fix and coordinated the upgrade with validators\/full node operators. No funds were lost. The network is stable.\u201d\u00a0<\/span><\/p><\/blockquote>\n It\u2019s important to remember that the crypto ecosystem was concerned with the way that they managed to do all this. It seemed centralized. However, the co-founder assured everyone that \u201cThe network is run by validators and full node operators, and we have no control over any of these groups. We just did our best to communicate and explain the importance of this upgrade, but ultimately it was up to them to decide whether they will do it or not.\u201d<\/span><\/p>\n However, this was Polygon node operator Mikko Ohtamaa\u2019s further complaint:<\/span><\/p>\n \u201cNext time it happens can you at least announce a critical update to all Polygon node operators. Now this looks super unprofessional and confusing for the community. It was not mentioned or pinned down in any major channels or publications.\u201d<\/span><\/p><\/blockquote>\n And that\u2019s the story so far.<\/span><\/p>\n Considering the infamous <\/span>Poly Network exploit<\/span><\/a> was merely in August this year, it\u2019s good to hear Polygon is working hard in securing their whole operation. They\u2019ve \u201dbeen investing significant effort and resources into creating an ecosystem of security expert partners, with the goal of improving the security and robustness of all Polygon solutions and products.\u201d With that in mind, this is the company\u2019s version of what happened:<\/span><\/p>\n \u201cRecently, a group of whitehat hackers on the bug bounty platform Immunefi disclosed a vulnerability in the Polygon PoS genesis contract. The Polygon core team engaged with the group and Immunefi\u2019s expert team and immediately introduced a fix. The validator and full node communities were notified, and they rallied behind the core devs to upgrade the network. The upgrade was executed within 24 hours, at block #22156660, on Dec. 5.\u201d<\/span><\/p><\/blockquote>\n So far, so good. This rhymes with Bjelic\u2019s explanation and gives the community more details. However, we know that they barely notified the validators and node operators. They don\u2019t even have to lie about it, because they do have a great reason as to why they ran the whole operation in stealth mode.<\/span><\/p>\n \u201cConsidering the nature of this upgrade, it had to be executed without disclosing the actual vulnerability and without attracting too much attention. We are still finalizing our vulnerability disclosure policy and procedures, and for now we are trying to follow the \u201csilent patches\u201d policy introduced and used by the Geth team.\u201d<\/span><\/p><\/blockquote>\n According to Ohtamaa, \u201cthere are multiple open source projects out there\u201d that have done similar operations in a more effective manner. And that might be true, but it doesn\u2019t take from the fact that Polygon\u2019s actions were justified.\u00a0\u00a0<\/span><\/p>\n <\/p>\n In the end, the critical update worked out fine enough:<\/span><\/p>\n \u201cThe vulnerability was fixed and damage was mitigated, with there being no material harm to the protocol and its end-users. All Polygon contracts and node implementations remain fully open source.\u201d<\/span><\/p><\/blockquote>\n Related Reading | Polygon Opens Vault On MakerDAO, Commits $50 Million Worth Of Matic Tokens<\/a><\/strong><\/em><\/p>\n Remember, one of the early criticism was that they forked the Polygon blockchain \u201cto a completely closed-source genesis.\u201d Here, the official source assures that \u201ccontracts and node implementations remain fully open source.\u201d Good. Is there something else they want to tell us?<\/span><\/p>\n \u201cWe are still working on closing the final proceedings with Immunefi and the whitehat hacker group, primarily in terms of their rewards and multiple rounds of reviews of the fixed vulnerability. We will post a detailed postmortem once this process is finished, likely by the end of next week.\u201d<\/span><\/p><\/blockquote>\n The team will publish yet another post with even more details for the technically oriented people. That\u2019s above our pay grade. Stay tuned to <\/span>Polygon\u2019s blog<\/span><\/a> if you\u2019re interested.\u00a0\u00a0<\/span><\/p>\n The Polygon team promised an explanation and here it is. A few weeks ago, the Ethereum Layer 2 network hard-forked their blockchain, seemingly without explanation. As usual, NewsBTC got to the bottom of the case and presented all of the available information. The only piece missing was a promised official report from Polygon\u2019s experts. Is this it? Apparently so.\u00a0 Related Reading | Community Voted, Why Uniswap Will Be Deployed On Polygon Before we get into it, let\u2019s remember Polygon\u2019s co-founder Mihailo Bjelic\u2019s explanation as reported by us:\u00a0 \u201cWe\u2019re making an effort to improve security practices across all Polygon projects,\u201d Bjelic tweeted. \u201cAs a part of this effort, we are working with multiple security researcher groups, whitehat hackers etc. One of these partners discovered a vulnerability in one of the recently verified contracts. We immediately introduced a fix and coordinated the upgrade with validators\/full node operators. No funds were lost. The network is stable.\u201d\u00a0 It\u2019s important to remember that the crypto ecosystem was concerned with the way that they managed to do all this. It seemed centralized. However, the co-founder assured everyone that \u201cThe network is run by validators and full node operators, and we have no control over any of these groups. We just did our best to communicate and explain the importance of this upgrade, but ultimately it was up to them to decide whether they will do it or not.\u201d However, this was Polygon node operator Mikko Ohtamaa\u2019s further complaint: \u201cNext time it happens can you at least announce a critical update to all Polygon node operators. Now this looks super unprofessional and confusing for the community. It was not mentioned or pinned down in any major channels or publications.\u201d And that\u2019s the story so far. What Did The Polygon Experts Say? Considering the infamous Poly Network exploit was merely in August this year, it\u2019s good to hear Polygon is working hard in securing their whole operation. They\u2019ve \u201dbeen investing significant effort and resources into creating an ecosystem of security expert partners, with the goal of improving the security and robustness of all Polygon solutions and products.\u201d With that in mind, this is the company\u2019s version of what happened: \u201cRecently, a group of whitehat hackers on the bug bounty platform Immunefi disclosed a vulnerability in the Polygon PoS genesis contract. The Polygon core team engaged with the group and Immunefi\u2019s expert team and immediately introduced a fix. The validator and full node communities were notified, and they rallied behind the core devs to upgrade the network. The upgrade was executed within 24 hours, at block #22156660, on Dec. 5.\u201d So far, so good. This rhymes with Bjelic\u2019s explanation and gives the community more details. However, we know that they barely notified the validators and node operators. They don\u2019t even have to lie about it, because they do have a great reason as to why they ran the whole operation in stealth mode. \u201cConsidering the nature of this upgrade, it had to be executed without disclosing the actual vulnerability and without attracting too much attention. We are still finalizing our vulnerability disclosure policy and procedures, and for now we are trying to follow the \u201csilent patches\u201d policy introduced and used by the Geth team.\u201d According to Ohtamaa, \u201cthere are multiple open source projects out there\u201d that have done similar operations in a more effective manner. And that might be true, but it doesn\u2019t take from the fact that Polygon\u2019s actions were justified.\u00a0\u00a0 MATIC price chart on Binance | Source: MATIC\/USD on TradingView.com The Aftermath In the end, the critical update worked out fine enough: \u201cThe vulnerability was fixed and damage was mitigated, with there being no material harm to the protocol and its end-users. All Polygon contracts and node implementations remain fully open source.\u201d Related Reading | Polygon Opens Vault On MakerDAO, Commits $50 Million Worth Of Matic Tokens Remember, one of the early criticism was that they forked the Polygon blockchain \u201cto a completely closed-source genesis.\u201d Here, the official source assures that \u201ccontracts and node implementations remain fully open source.\u201d Good. Is there something else they want to tell us? \u201cWe are still working on closing the final proceedings with Immunefi and the whitehat hacker group, primarily in terms of their rewards and multiple rounds of reviews of the fixed vulnerability. We will post a detailed postmortem once this process is finished, likely by the end of next week.\u201d The team will publish yet another post with even more details for the technically oriented people. That\u2019s above our pay grade. Stay tuned to Polygon\u2019s blog if you\u2019re interested.\u00a0\u00a0 Featured Image by Diana Polekhina on Unsplash – Charts by TradingView<\/p>\n","protected":false},"author":539,"featured_media":479955,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3],"tags":[1946,2292,40670,84377,85068,3281,84020,85066,83584,85067,84945,85065],"class_list":["post-479954","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-ethereum","tag-hard-fork","tag-matic","tag-mihailo-bjelic","tag-mikko-ohtamaa","tag-open-source","tag-poly-hack","tag-poly-network-exploit","tag-polygon","tag-polygon-core-team","tag-problems-at-polygon","tag-whitehat-hackers"],"acf":[],"yoast_head":"\nWhat Did The Polygon Experts Say?<\/span><\/h2>\n
MATIC price chart on Binance | Source: MATIC\/USD on TradingView.com<\/a><\/pre>\n
The Aftermath<\/span><\/h2>\n
Featured Image by Diana Polekhina<\/a> on Unsplash<\/a> - Charts by TradingView<\/a><\/pre>\n","protected":false},"excerpt":{"rendered":"