Flare Network Prevents Ronin Network & Multisig Hack Problem

If you have followed the happenings in crypto for the past fortnight, you may be familiar with the Ronin network exploit that threatened a $620 million loss in cryptocurrencies. The unofficial post mortem shows the hackers used compromised private keys to forge withdrawal signatures, an issue that has raised eyebrows across the crypto field. 

This piece focuses on what transpired in the Ronin network attack, how the hackers transferred the funds, and the solutions available to prevent such a multisig hack in the future. 

Understanding the Ronin Network Hack

On March 29, Axie Infinity sidechain, Ronin network issued a community warning that the network was under attack, with 173,600 ETH and 25.5 million USDC being transferred to a hacker’s wallet, resulting in a loss of close to $620 million. According to unofficial post mortem results from the SlowMist blockchain security team, the hack was conducted via a compromise of the Ronin network validator nodes. 

In the community warning sent by Sky Mavis, the parent company of the Ronin network, the hack was completed on March 23 but went unnoticed until some of the users reported that they were unable to withdraw some of their funds from the bridge. According to the release, the hacker used compromised private keys to access and withdraw funds from the bridge in only two transactions. 

To understand better, the Ronin network consists of nine validator nodes. These validator nodes verify the deposits and withdrawals from the Ronin chain, with five of the nine validator nodes required to sign the transactions. The attacker managed to get control over Sky Mavis’s four Ronin Validators and a third-party validator run by Axie DAO. 

The whole debacle can be traced back to November 2021, when Sky Mavis delegated the Axie Infinity DAO to help distribute free transactions. However, the huge number of transactions forced Axie DAO to whitelist Sky Mavis, allowing the company to sign various transactions to lessen the burden. 

While the transactions were reduced, the whitelist access was never revoked, which allowed the attacker to gain access to the Sky Mavis system and sign the transactions as a validator. 

According to Sky Mavis, the hacker found a backdoor through the gas-free RPC node and got the signature for the Axie DAO validator, which allowed him to withdraw over $620 million in cryptocurrencies. 

Multisig platforms being hacked seems to be growing, with the Wormhole bridge also suffering a hack recently. Unlike the Ronin network, Wormhole bridge users were not so lucky as hackers were able to steal hundreds of millions. The Wormhole hack involved a smart contract exploit that tricked the multisig-based bridge into showing that wrapped Ethereum (wETH) had been deposited into the Solana bridging contract and redeemed on Ethereum. 

Despite the recent hacks, multisig platforms provide an added layer of decentralization to prevent such hacks and provide better security. While this is not the case currently, the idea behind multisig wallets is still functional. Luckily, the crypto world is gradually building solutions to prevent these recent multisig-based hacks, Flare’s LayerCake bridge becoming the latest to provide solutions to this problem. 

Solving the Multisig Hack Problem

Flare network, a blockchain platform that allows secure interoperability between chains, aims to give solutions to the multisig problem via its LayerCake model. This model proposes a monetary “Bandwidth Providers (BPs)” system that owns the signing rights to move a specific amount of value across the bridge per unit of time. 

At the moment, it is proposed to be every one hour. The “Bandwidth” is the amount of value they may move across the bridge in any unit of time, enforced by the smart contracts, is the “Bandwidth”. 

To prevent the signatories or someone with access to the signatories from stealing or compromising the system, BPs must deposit the same amount of value of funds being bridged to the LayerCake smart contract. This ensures that if all the BPs or signatories conspire to trick the system (Bandwidth), there’s the same amount of value stored in the smart contract to cover the loss. 

The LayerCake model also introduces an open secondary system of incentivized observers that find and remove any malicious BPs from signing the bridge transactions. Hence any malicious bandwidth provider can be removed within a single unit of time, and the collateral provided by the BPs always covers bridge user funds. If all of the BP’s are malicious, the system can still operate through a relay between the chains, albeit more slowly.

Finally, the system also protects users from reorganization attacks by collateralizing the BPs directly on Flare for a period of time such that reorganization attacks have a negligible probability. In a reorganization attack, the collateral staked by the BPs is used to reimburse the users’ funds on the bridge.