Arbitrum’s Security Council did not need the private key of the address it emptied on Oct. 30, according to a walkthrough Zealynx posted Nov. 2 on the Ethereum Magicians forum. At 8:08 a.m. Hong Kong time, the council took 74,559,805.2 ARB and about 8,426 ETH off that address, which its notice said was “identified with today’s Binance exploit.”
The council had done the same in April. Its April notice says it moved more than 30,765 ETH that the KelpDAO exploiter held on Arbitrum One, a freeze Unchained covered at the time.
Steven Goldfeder, co-founder and CEO of Offchain Labs, which develops Arbitrum, said on Unchained’s Uneasy Money in July that the council’s role in the April action was by design. The power sat with “this external entity” that is “broadly elected,” he said, and “it wasn’t like me that had the power to do that.”
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
Inside the Council’s Transaction
According to Zealynx, the council’s Safe, which currently requires nine of its 12 signers, called Arbitrum’s UpgradeExecutor in a single Ethereum transaction in block 26301886. For a moment the executor ran the Inbox on override code that logs the target address, unaliased, as the message’s sender, then restored the original code once the message was in. It repeated that for each asset, ARB first and ETH second.
Unchained’s own read of Ethereum and Arbitrum One chain data matches that account. Both messages executed on Arbitrum One 9 minutes and 45 seconds after the Ethereum transaction, as type 0x65 transactions with zeroed signature fields. They used the address’s nonces 2 and 3: the first sent the ARB to a holding address ending in 0DA0, and the second sent 8,425.99768 ETH there.
Nothing in the token’s logs gives the move away, Zealynx wrote: the ARB contract and indexers see a plain transfer that the holder appears to have made. On Arbitrum One, what sets it apart is the transaction’s type, 0x65, and its blank signature.
Funds Await a DAO Vote
The council’s notice says the funds “can only be moved by an ArbitrumDAO Governance vote, which will be coordinated with relevant parties,” and that “no other user’s funds or applications were affected.” The freeze came hours after Binance’s hot wallets were drained, a loss the exchange has put at about $6.3 billion.
Zealynx wrote that it does not “see a bug in any of this.” The council “used powers the DAO gave it and published both actions within an hour and a half,” the post said. Its point is aimed at builders. When a spec promises that only a key can move a wallet, Zealynx wrote, “on these chains that holds up to whoever controls the upgrade path.” On Arbitrum One, both the council’s emergency Safe and the DAO’s timelock on Ethereum hold that path, according to the post.
Related Listen: Why Griff Green Initially Opposed the Arbitrum Freeze
The post Arbitrum’s Security Council Can Move a Wallet’s Funds Without Its Key, Binance Freeze Shows appeared first on Unchained.
Powered by WPeMatico
