Polygon Fixes A Bug That Would Have Led To The Loss Of $23.65 Billion In MATIC Tokens

Ethereum side-chain project Polygon has paid out a $2.2 million bug bounty in stablecoins to whitehat Leon Spacewalker and another $1.26 million to Whitehat2 in MATIC tokens for reporting the critical vulnerability in the protocol.

The bug bounty was in excess of the maximum value of Polygon’s critical bounty in recognition of the severity of the vulnerability.

If gone unnoticed, the bug would have allowed an attacker to steal all 9.27 billion MATIC (worth $23.65 billion as of writing) from the contract.

“Considering the nature of this upgrade, it had to be executed without attracting too much attention,” said the team on Wednesday in its official announcement.

Before the fix was implemented, on Dec. 5 at block #22156660, 801,601 MATIC tokens (about $2 million) were stolen by a blackhat using the same exploit.

Polygon has since then implemented the fix to the bug that was reported by the whitehats earlier this month.

On Wednesday, Immunefi, a bug bounty platform that assisted in the investigation and advised the hard fork operation, wrote a post mortem in which it shared that the vulnerability was a lack of balance/allowance check in Polygon’s MRC20 standard’s transfer function.

The MATIC token is the native token of the Polygon ecosystem, which is used for paying gas costs, contributing to security through staking, and voting on Polygon Improvement Proposals (PIPs).

Besides being the native gas-paying asset of the Polygon network, MATIC is also an MRC20 contract deployed on Polygon. The MRC20 standard is used for transferring MATIC gaslessly, where the operator pays for the gas and is facilitated by the transferWithSig() function.

“All projects that achieve any measure of success sooner or later find themselves in this situation,” said Polygon’s co-founder Jaynti Kanani. “What’s important is that this was a test of our network’s resilience as well as our ability to act decisively under pressure. Considering how much was at stake, I believe our team has made the best decisions possible given the circumstances.”

The $17.5 billion market cap token MATIC is currently trading at $2.56, down 12.2% from its all-time high of $2.92 hit this Monday. The coin is one of the best performers of 2021, with 14,242% returns.