Incident History Repository¶
The incident history repository documents incidents: timeline, root cause, and corrective actions.
4 October 2021 - Withdrawal Credentials Exploit (prelaunch bug bounty submisssion)¶
A node operator exploiter can front run validator withdrawal credentials and steal rETH funds.
- Initial public announcement
- Update public announcement
- Solution update
- Report and corrective actions
26 May 2022 - Workstation Hijack¶
A team member’s workstation was hijacked using a remote execution exploit. Two unencrypted ssh keys were present on the team member’s workstation and allowed access to the two ODAO nodes. The attacker gained access to the two ODAO node private keys and drained the accounts of funds.
- Report: 2022-05-26 Workstation Hijack
- Public Disclosure:
24 Oct 2022 - Malicious registered node with staking minipool can withdraw all of their RPL collateral¶
Medium bug bounty submission that we decided to pay out and fix in the following release (Atlas).
20 September 2022 - Fee Distributor smart contract occasionally calculates the node operator's share of its balance incorrectly¶
The Fee Distributor smart contract occasionally calculated the node operator's share of its balance incorrectly. The impact is relatively minor, affecting a small number of node operators, but we preparied an update to resolve it.
5 Febuary 2023 - RPL staking grief¶
16 March 2023 - Low severity bug bounty submission disclosure¶
17 July 2023 - Discord compromised¶
18 January 2024 - Twitter compromised¶
15 May 2024 - pDAO delegate Houston issue (prelaunch)¶
- Initial public announcement
- Houston hotfix:
21 June 2024 - pre-Atlas 16 ETH minipool exits¶
- Initial public announcement
- Houston hotfix: