{"id":910,"date":"2022-06-15T12:00:00","date_gmt":"2022-06-15T12:00:00","guid":{"rendered":"https:\/\/grandpascrypto.com\/?p=910"},"modified":"2022-06-14T16:12:46","modified_gmt":"2022-06-14T16:12:46","slug":"osmosis-loses-5-million-due-to-a-bug","status":"publish","type":"post","link":"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/","title":{"rendered":"Osmosis Loses $5 Million Due to a Bug"},"content":{"rendered":"\n<p><em><strong>tl;dr Summary:<\/strong> A bug was introduced as part of the new version 9.0 update to Osmosis, resulting in attackers draining $5 million from this popular DEX on the Cosmos ecosystem.<\/em><\/p>\n\n\n\n<p>On June 8, 2022, the Osmosis team released their new version, v9.0, which contained a critical bug. This bug could potentially lead to attackers draining all the liquidity from their pool.&nbsp;<\/p>\n\n\n\n<p>The problem was spotted and reported by Reddit user <a href=\"https:\/\/www.reveddit.com\/v\/cosmosnetwork\/comments\/v7ee8y\/bug_on_osmosis_there_is_a_serious_problem_with\/\">Straight Hat<\/a>, who said he found a bug on Osmosis that allowed him to take out 50% more than he put in. Initially, people had a tough time believing his claims until they tried it.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"201\" src=\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/image-3-1024x201.png\" alt=\"\" class=\"wp-image-911\" srcset=\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/image-3-1024x201.png 1024w, https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/image-3-300x59.png 300w, https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/image-3-768x151.png 768w, https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/image-3-150x29.png 150w, https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/image-3-696x137.png 696w, https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/image-3-1068x210.png 1068w, https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/image-3.png 1252w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Another user, Jun\u00f8naut reported that it is pretty easy to take advantage of this bug. All that is required is adding some liquidity to the pool, taking it out with 50% extra, and then repeating the process. He also shared an example of an <a href=\"https:\/\/twitter.com\/TheJunonaut\/status\/1534402707766890496?s=20&amp;t=2lupJIIrcHgSnkuDPL7qVw\">address<\/a> that repeatedly exploited this bug to make massive gains.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">The exploit was very simply executed :-<br>1. Add liquidity to a pool<br>2. Remove liquidity from the pool allowing 50% extra. No bonding needed.<br>3. Rinse and repeat <a href=\"https:\/\/t.co\/FHgNgA3ntK\">pic.twitter.com\/FHgNgA3ntK<\/a><\/p>&mdash; Jun\u00f8naut (@TheJunonaut) <a href=\"https:\/\/twitter.com\/TheJunonaut\/status\/1534402712430956549?ref_src=twsrc%5Etfw\">June 8, 2022<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>Once the validators noticed the issue, the Osmosis team <a href=\"https:\/\/twitter.com\/TheJunonaut\/status\/1534402718323949570?s=20&amp;t=2lupJIIrcHgSnkuDPL7qVw\">stopped<\/a> the chain to prevent further damage.&nbsp;<\/p>\n\n\n\n<p>Responding to the community, the Osmosis team <a href=\"https:\/\/twitter.com\/osmosiszone\/status\/1534432704246292480?s=20&amp;t=2lupJIIrcHgSnkuDPL7qVw\">reassured<\/a> them that the liquidity pools are mostly intact and that the loss so far amounted to approximately $5 million. They also mentioned that the devs are working on fixing the problem.&nbsp;<\/p>\n\n\n\n<p>The team also identified four persons who accounted for 95% of the stolen assets. Out of which two agreed to refund the money. The remaining two used centralized exchanges to move these assets with which the team was in contact to help recover them.&nbsp;<\/p>\n\n\n\n<p>The Osmosis team <a href=\"https:\/\/twitter.com\/osmosiszone\/status\/1534684195884351489?s=20&amp;t=2lupJIIrcHgSnkuDPL7qVw\">tweeted<\/a>:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-pullquote\"><blockquote><p>&#8220;<em>The bug itself was simple. It involved incorrect calculation of LP shares when adding and removing liquidity from pools. It should have been caught. It was painfully overlooked in internal testing. That was focused on more advanced functionality related to the upgrade.&#8221;<\/em><\/p><\/blockquote><\/figure>\n\n\n\n<p>They also said that the Osmosis development team takes <a href=\"https:\/\/twitter.com\/osmosiszone\/status\/1534684201206919170?s=20&amp;t=2lupJIIrcHgSnkuDPL7qVw\">full responsibility<\/a> for lost funds since this was a technical bug and assured the community that this would never happen again.&nbsp;<\/p>\n\n\n\n<p>The latest update tells us that the validators restarted the chain with the new code yesterday at 14:00 UTC. To compensate for the downtime, the first five blocks to be validated will be &#8220;<a href=\"https:\/\/twitter.com\/Daveflowers91\/status\/1535918672006488070?s=20&amp;t=2lupJIIrcHgSnkuDPL7qVw\">Epoch<\/a>&#8221; blocks.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">Rewards come in at 1700utc every day.  Every 24 hours is an epoch. So it&#39;s been down like 3 days right, it&#39;s going to distribute the missed rewards per epoch and it sounds like that may take about 90 minutes.<\/p>&mdash; Daveflowers9 (@Daveflowers91) <a href=\"https:\/\/twitter.com\/Daveflowers91\/status\/1535918672006488070?ref_src=twsrc%5Etfw\">June 12, 2022<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>Osmosis has a special place within the Cosmos ecosystem. It is the only DEX made using the inter-blockchain (IBC), which allows for the exchange of assets with other IBC-supported blockchains on its platform. To complement great tech, how the Osmosis community comprising its users and developers came together in this time of crisis to collectively address the problem needs <a href=\"https:\/\/twitter.com\/osmosiszone\/status\/1534684207808643076?s=20&amp;t=2lupJIIrcHgSnkuDPL7qVw\">acknowledgment<\/a>.&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A bug was introduced as part of the new version 9.0 update to Osmosis, resulting in attackers draining $5 million from this popular DEX on the Cosmos ecosystem.<\/p>\n","protected":false},"author":2,"featured_media":916,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55],"tags":[1487,1483,71,359,1486,91,1125,1124,1485,534,1484],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v18.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Osmosis Loses $5 Million Due to a Bug - grandpascrypto.com\" \/>\n<meta property=\"og:description\" content=\"A bug was introduced as part of the new version 9.0 update to Osmosis, resulting in attackers draining $5 million from this popular DEX on the Cosmos ecosystem.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/\" \/>\n<meta property=\"og:site_name\" content=\"grandpascrypto.com\" \/>\n<meta property=\"article:published_time\" content=\"2022-06-15T12:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-06-14T16:12:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/Osmosis-bug.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Basil\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/grandpascrypto.com\/#website\",\"url\":\"https:\/\/grandpascrypto.com\/\",\"name\":\"grandpascrypto.com\",\"description\":\"Crypto explained so well that your grandpa can understand\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/grandpascrypto.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/Osmosis-bug.png\",\"contentUrl\":\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/Osmosis-bug.png\",\"width\":1280,\"height\":720},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/#webpage\",\"url\":\"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/\",\"name\":\"Osmosis Loses $5 Million Due to a Bug - grandpascrypto.com\",\"isPartOf\":{\"@id\":\"https:\/\/grandpascrypto.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/#primaryimage\"},\"datePublished\":\"2022-06-15T12:00:00+00:00\",\"dateModified\":\"2022-06-14T16:12:46+00:00\",\"author\":{\"@id\":\"https:\/\/grandpascrypto.com\/#\/schema\/person\/4695d8c61ac1241fdaef7825e979754d\"},\"breadcrumb\":{\"@id\":\"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/grandpascrypto.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Osmosis Loses $5 Million Due to a Bug\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/grandpascrypto.com\/#\/schema\/person\/4695d8c61ac1241fdaef7825e979754d\",\"name\":\"Manish Kumar Singh\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/grandpascrypto.com\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":{\"url\":\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/02\/Manish.png\",\"url2x\":\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/02\/Manish.png\"},\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3d76631a60bf1a7fbc3039e3cd1d1aa6?s=96&d=mm&r=g\",\"caption\":\"Manish Kumar Singh\"},\"url\":\"https:\/\/grandpascrypto.com\/author\/manish-kumar-singh\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/","og_locale":"en_US","og_type":"article","og_title":"Osmosis Loses $5 Million Due to a Bug - grandpascrypto.com","og_description":"A bug was introduced as part of the new version 9.0 update to Osmosis, resulting in attackers draining $5 million from this popular DEX on the Cosmos ecosystem.","og_url":"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/","og_site_name":"grandpascrypto.com","article_published_time":"2022-06-15T12:00:00+00:00","article_modified_time":"2022-06-14T16:12:46+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/Osmosis-bug.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Written by":"Basil","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/grandpascrypto.com\/#website","url":"https:\/\/grandpascrypto.com\/","name":"grandpascrypto.com","description":"Crypto explained so well that your grandpa can understand","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/grandpascrypto.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/#primaryimage","inLanguage":"en-US","url":"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/Osmosis-bug.png","contentUrl":"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/06\/Osmosis-bug.png","width":1280,"height":720},{"@type":"WebPage","@id":"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/#webpage","url":"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/","name":"Osmosis Loses $5 Million Due to a Bug - grandpascrypto.com","isPartOf":{"@id":"https:\/\/grandpascrypto.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/#primaryimage"},"datePublished":"2022-06-15T12:00:00+00:00","dateModified":"2022-06-14T16:12:46+00:00","author":{"@id":"https:\/\/grandpascrypto.com\/#\/schema\/person\/4695d8c61ac1241fdaef7825e979754d"},"breadcrumb":{"@id":"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/grandpascrypto.com\/osmosis-loses-5-million-due-to-a-bug\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/grandpascrypto.com\/"},{"@type":"ListItem","position":2,"name":"Osmosis Loses $5 Million Due to a Bug"}]},{"@type":"Person","@id":"https:\/\/grandpascrypto.com\/#\/schema\/person\/4695d8c61ac1241fdaef7825e979754d","name":"Manish Kumar Singh","image":{"@type":"ImageObject","@id":"https:\/\/grandpascrypto.com\/#personlogo","inLanguage":"en-US","url":{"url":"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/02\/Manish.png","url2x":"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/02\/Manish.png"},"contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3d76631a60bf1a7fbc3039e3cd1d1aa6?s=96&d=mm&r=g","caption":"Manish Kumar Singh"},"url":"https:\/\/grandpascrypto.com\/author\/manish-kumar-singh\/"}]}},"authors":[{"term_id":161,"user_id":0,"is_guest":1,"slug":"manish-kumar-singh","display_name":"Manish Kumar Singh"}],"_links":{"self":[{"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/posts\/910"}],"collection":[{"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/comments?post=910"}],"version-history":[{"count":2,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/posts\/910\/revisions"}],"predecessor-version":[{"id":921,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/posts\/910\/revisions\/921"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/media\/916"}],"wp:attachment":[{"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/media?parent=910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/categories?post=910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/tags?post=910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}