White hat hacker grumbles over Arbitrum bounty reward after saving network from $475M loss White hat hacker grumbles over Arbitrum bounty reward after saving network from $475M loss
The white hat hacker believes his discovery deserves the full $2 million max bounty reward instead of only 400 ETH.
2 min read
Updated: Sep. 21, 2022 at 1:47 pm UTC
Cover art/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.
Riptide, a white hat hacker that discovered a vulnerability on Arbitrum, tweeted that his find was eligible for the max bounty reward of $2 million instead of the 400 ETH ($53,000) reward he got.
No big deal just bridging a cool $470mm through the same Inbox contract ๐
Definitely should be eligible for a max bounty
— riptide (@0xriptide) September 20, 2022
Ethereum scaling tool Arbitrum escaped a multimillion-dollar hack after the hacker spotted a vulnerability in the bridge connecting the layer2 network to ETH’s mainnet. The vulnerability affected how transactions are submitted and processed on the network and would have allowed malicious players to steal all the funds sent to the layer2 network.
The vulnerability
According to the white hat hacker, incoming transactions to Arbitrum through the bridge could be hijacked by malicious players who could set their address as the recipient address.
Riptide continued that such an exploit could have gone undetected for a long time if the hacker targeted only large ETH deposits, or they could have just front-ran the next major ETH deposit.
Given that the largest deposit on the inbox contract in the last 24 hours was 168,000 ETH ($250 million), exploiting the vulnerability could have led to a loss of hundreds of millions.
Bounty reward
While Riptide initially praised Arbitrum for the 400 ETH reward, the white hat hacker later tweeted that his work deserved the maximum bounty of $2 million.
Riptide said:
โMy point is that if you post a $2mm bounty โ be prepared to pay it when itโs justified. Otherwise, just say the max bounty is 400 ETH and be done with it. Hackers watch which projects pay out and which do not. IMO not a good idea to incentivize a whitehat to go blackhat.โ
Riptide’s new comments were made after a Twitter user showed that the bridge was recently used to transfer over $400 million.
Doing this again since my other quote tweet got censored by tweeter. Arbitrum bridge bug is critical bridge bug #3 caused by bad initializers, in case we needed another reason to get rid of initializers. Surprised Arbitrum only paid 400 ETH and not max bounty given deposits like: https://t.co/Lx32UVjDtF pic.twitter.com/cmSx1HMI1k
— smartcontracts.eth (โจ๐ด_๐ดโจ) (@kelvinfichter) September 20, 2022
Meanwhile, bridge exploits are one of the biggest security concerns in the crypto industry presently. Attacks on bridges have led to the loss of almost $1 billion in the past year alone.
Author 
Oluwapelumi Adejumo
Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.
Latest Ethereum Stories
Featured Story
Advertise Here
In this article
Ethereum is a decentralized, open-source blockchain platform that enables the creation of smart contracts and decentralized applications (DApps).
