Virtuals Protocol, a blockchain agency specializing in synthetic intelligence brokers, has resolved a vital bug in considered one of its audited good contracts.
A pseudonymous safety researcher recognized a vital vulnerability within the undertaking audited contract, prompting an pressing repair. The corporate has additionally relaunched its bug bounty program to forestall future vulnerabilities.
Virtuals Protocol Vulnerability May Block Token Launches: Is This A Good Contract Bug Or Function?
On December 3, 2024, pseudonymous safety researcher Jinu found a vital vulnerability in considered one of Virtuals Protocol’s audited good contracts.
The researcher promptly reported the problem to Virtuals Protocol, however the firm didn’t have an energetic bug bounty program.
Consequently, regardless of its potential affect on the protocol’s ecosystem, the invention didn’t qualify for a reward.
After posting on X, I acquired in contact with the @virtuals_io workforce. They patched it in a short time.https://t.co/VywvsdFcxVhttps://t.co/jd3Mmcxq43
— jinu (@lj1nu) January 3, 2025
The vulnerability stemmed from the platform token-launching mechanism on Uniswap V2 has been uncovered.
The flaw lies in how Virtuals creates token pairs, a course of much like Pump.enjoyable’s technique of launching tokens by worth thresholds and bonding mechanisms.
Safety researcher Jinu recognized a vital difficulty that might block Virtuals from launching new tokens.
He identified that the AgentToken creation course of makes use of the Clones library, which makes future token addresses predictable based mostly on the AgentFactoryV3 contract’s nonce.
Moreover, the initialize operate within the AgentToken contract calls Uniswap V2’s createPair operate with out verifying if a pair already exists.
If one does, Uniswap V2’s manufacturing facility reverts the transaction. This flaw additionally allows the creation of pairs with non-existent contracts.
An attacker may exploit this by preemptively making a Uniswap pair with the expected nonce, stopping Virtuals from launching its tokens. Jinu demonstrated this exploit utilizing a proof of idea on Tenderly.
Jinu really useful modifying the AgentToken.sol contract to test for current pairs in Uniswap V2 earlier than trying creation, skipping the method if a pair already exists.
Regardless of the severity of the problem, Virtuals didn’t reply, even closing its devoted Discord group meant for reporting vulnerabilities.
Jinu expressed frustration on the oversight, remarking, “I’m shocked {that a} undertaking as massive and sizzling as Virtuals doesn’t care about safety.”
Virtuals Protocol Recognize Jinu for Highlighting Flaw: What’s Subsequent for Bug Bounties?
Following Jinu’s public disclosure of the problem on X (previously Twitter), Virtuals Protocol contacted Jinu and applied a speedy repair.
The corporate acknowledged the bug’s severity and apologized for the preliminary miscommunication.
In a message to Jinu, Virtuals Protocol stated:
“We have now verified the vulnerability and utilized a patch. Thanks for bringing this to our consideration. We apologize for the miscommunication and can evaluation the severity of the problem to find out a bug bounty.”
They patched the vulnerability by updating the contract to incorporate the mandatory validation steps. For transparency, the brand new contract and repair particulars had been printed on BaseScan and GitHub.
Nonetheless, Virtuals Protocol has but to substantiate the reward quantity for Jinu’s discovery. The corporate said that it internally assesses the affect of the vulnerability earlier than issuing a bounty.
The publish Virtuals Protocol Fixes Vital Bug, Rewards Safety Researcher appeared first on Cryptonews.