Solana bug that put tokens worth $2 billion at risk fixed

A couple of months ago, a bug was detected by Neodyme, a security auditing firm in the token lending contract of the Solana Program Library (SPL). The bug had put the funds of many protocols at risk. It was fixed on December 3 by Neodyme according to the auditing firm’s blog post. The Solana Program Library (SPL) is a collection of on-chain programs targeting the Sealevel parallel runtime.Sealevel is the world's first parallel smart contracts run time. These programs are tested against Solana's implementation of Sealevel, solana-runtime, and deployed to its mainnet. Though Neodyme had alerted Solana months before about it, due to its seemingly harmless effect the bug was not resolved.
The bug led to a rounding error that produces more tokens than the ones being deposited by the users to the contract. However the bug could not be exploited without an organized attack that targeted the vulnerability directly. Neodyme addressed the problem and explained the following points about the bug in its blog post:
* Neodyme managed to reproduce the bug and create a script that took advantage of it.
* The bug could have affected several decentralized applications and risked nearly $2.6 billion in total value locked (TVL).
* Some low-value coins on Solana were not economically viable to steal, but the potential profit could have easily gone up to hundreds of millions.
* After fixing the bug, all the decentralized apps were updated promptly to close the vulnerability.
* Neodyme emphasized that the most secure code is open-source, and one of the best ways to write better code is to understand vulnerabilities.
- Over $2 billion in several tokens were at the risk of being drained gradually due to the bug.
- Moreover, if the attack was conducted in a better way, it wouldn’t have even triggered any alarm, and would just be seen as a slow drainage of Annual Percentage Yield (APY) in some pools.
(For the latest crypto news and investment tips, follow our Cryptocurrency page and for live cryptocurrency price updates, click here.)