Early this morning a #tBTC contributor was having difficulty using the alpha version of the dApp. The team noticed the issue on-chain, and discovered a broader vulnerability in the system.
The team took rapid steps to ensure that all funds stayed safe, using the privileged key's ability to pause deposits for the next 10 days.
We are happy to share that over 99.7% of all TBTC has been collected in one wallet controlled by the development team, and is being withdrawn. Remaining BTC deposits can be redeemed at their owners' convenience.
This issue has raised a few questions we'd like to answer before a formal report.
1) It appears that despite this issue, there was little risk to depositor's funds.
2) We don't have a kill-switch or the ability to upgrade the tBTC system. We've maintained a few key privileges, outlined below, to balance immutability and censorship-resistance while protecting user funds.
We employed a one-time-use 10-day pause, and will no longer be able to pause the system.
You can read more here.
tbtc.network/developers/tbt…
You can read more here.
tbtc.network/developers/tbt…
3) The tBTC system has been heavily audited, but an audit is not a guarantee of security. You can read the initial report here.
diligence.consensys.net/audits/2020/02…
diligence.consensys.net/audits/2020/02…
We had already planned a second audit to begin today. We're looking forward to continuing our work with @ConsenSysAudits and beginning to work with @trailofbits to further improve our security processes.
We're working on a detailed post-mortem explaining the facts and circumstances that led to this emergency action, and expect to share early tomorrow. We're incredibly grateful to the community for your support, and will keep you updated.
You can learn more by following @mhluongo's account of the event
as well as a recent article by @CoinDesk
coindesk.com/bug-forces-shu…
as well as a recent article by @CoinDesk
coindesk.com/bug-forces-shu…
