Ronin Hack

On August 6, 2024, the Ronin Network Bridge suffered an exploit resulting in the loss of $12 million, comprising $2 million in USDC and 4,000 ETH, due to a vulnerability introduced during a recent contract upgrade and exploited by an MEV-bot.

The vulnerability stemmed from an uninitialized variable in the upgraded bridge manager contract. The Ronin team transitioned from version 2 to version 4 and introduced a new implementation, MainchainGatewayV3. However, they neglected to call the initializeV3 function, which was necessary to initialize the _totalOperatorWeight variable in the contract’s storage.

This oversight caused the minimumVoteWeight parameter, a crucial security check for cross-chain verification, to be disabled. The MEV bot exploited this by executing a withdrawal transaction, seizing 4,000 ETH and $2 million in USDC.

WH exploit tx:

https://etherscan.io/tx/0x26195700…9ba6cb