According to a report, the Polygon, the Ethereum scaling project, was at serious risk of losing almost all of its MATIC tokens due to an issue of "critical" vulnerability in the main stake proof contract, which could have allowed intruders to steal more than 9,2 billion MATIC tokens.
The vulnerability was reported on the Immunefi bug bounty platform by a whitehat hacker known as Leon Spacewalker. According to details shared on Wednesday (29), the bug could have allowed the invaders to illegally take off more than 9,2 billion Polygon MATIC tokens in its MRC20 contracts.
After Spacewalker found the bug, Immunefi directly informed the Polygon team, who on the same day confirmed the vulnerability and made the first update on the network to fix the bug, starting with a test and then definitively.
According to Polygon, the testnet upgrade was completed on December 4th, and the team was preparing for the mainnet upgrade. However, before the mainnet update was done, a hacker managed to exploit the bug and stole 801.601 tokens. MATIC (currently valued at over $2 million). Polygon said it will bear the cost of the theft.
After the MATIC tokens were stolen, a second whitehat hacker (who remains anonymous) discovered the vulnerability and sent a report to Immunefi. Polygon then released a new emergency update for its core network on the 5th.
Even with the details of the incident being released only this Wednesday (29), several rumors were already circulating social networks throughout the month of December about silent and unannounced updates that Polygon performed on its platform.
Polygon co-founder Mihailo Bjelic even said there was a vulnerability and that the team would disclose more details in the future details. After identifying the faults, Polygon gave rewards worth approximately $3,46 million, with Spacewalker receiving $2,2 million in stablecoins and whitehat's anonymous hacker receiving 500 MATIC tokens.
