whileunless
commented
3 weeks ago USCD and Linea - centralized tools of oppression. This science of blacklisting is amusing. Best Linea could do is sell all their assets and give to the poor and needy.
Open piotrammain opened 3 weeks ago
whileunless
commented
3 weeks ago USCD and Linea - centralized tools of oppression. This science of blacklisting is amusing. Best Linea could do is sell all their assets and give to the poor and needy.
piotrammain
commented
3 weeks ago In light of recent security breaches and the significant financial implications for Linea, it is critical to understand the current lack of blacklisting activity on USDC.e (https://lineascan.build/token/0x176211869cA2b568f2A7D4EE941E073a821EE1ff#readProxyContract).
While the identity of the blacklister's address (https://lineascan.build/address/0x49ee40140E522651744e1C27828c76eE92802833) might be intentionally obfuscated(irony), the current policy of inherent blacklisting asymmetry seems insufficient. Security should be a top priority regardless of legal environments.
I urge a comprehensive and well-considered approach to the potential future introduction of Native USDC. This process must prioritize robust security measures to prevent any vulnerabilities or breaches.
gregorio500
commented
3 weeks ago Hopefully, someone addresses this soon. It's so frustrating to see the same centralization issues undermining the whole point of decentralization
Security Issues: Bridged USDC (USDC.e) and Potential Native USDC on Linea
Responsible Disclosure:
While I considered submitting a bug report on Immunefi, I understand this issue falls outside their scope (proof-of-concept being purely theoretical).
Introduction:
This report (purposefully without outlining a detailed attack scenario) details security concerns regarding Bridged USDC (USDC.e) on Linea and the potential introduction of native USDC. I advocate for stricter security standards exceeding those seen on Arbitrum or Optimism, minimizing attack surfaces and protecting the Linea ecosystem.
Lessons from Other Ecosystems - Blacklisting Vulnerabilities:
Security vulnerabilities exist within the Arbitrum ecosystem, particularly inconsistencies related to USDC blacklisting. Notably, blacklisted addresses on both mainnet USDC and Arbitrum-native USDC can interact with USDC.e on Arbitrum. This blacklisting asymmetry extends to discrepancies between USDC on mainnet and on Arbitrum.
Such asymmetry creates exploitable attack vectors actively researched by the security community.
Optimism vs. Arbitrum: Key Differences:
While both Optimism and Arbitrum face blacklisting asymmetry challenges, a crucial distinction exists. USDC.e on Arbitrum possesses blacklisting functionality, whereas USDC.e on Optimism currently does not (blacklisted by 0x0 address). Even with ideal blacklisting symmetry(between USDC on mainnet and Optimism), an inherent and permanent asymmetry would still exist between USDC and USDC.e on Optimism.
Similarly, USDC.e on zkSync lacks blacklisting functionality. Even with blacklisting symmetry between USDC on mainnet and zkSync, an inherent and permanent asymmetry exists between USDC and USDC.e on zkSync.
Linea's Blacklisting Concerns:
Particularly concerning is the lack of(active) blacklisting on Linea's USDC.e contract (blacklister's address not active)(https://lineascan.build/address/0x49ee40140E522651744e1C27828c76eE92802833) compared to mainnet USDC. Transaction history confirms this (https://lineascan.build/txs?a=0x49ee40140E522651744e1C27828c76eE92802833&p=1).
Possible Vulnerabilities:
Reliance on USDC for Blacklist Updates: Dependence on USDC for updates on Linea can create vulnerabilities due to potential delays or inconsistencies.
Centralized Control over Layer 2: Blacklist asymmetry concentrates power in the hands of Circle, potentially undermining the decentralized nature of Layer 2.
Composability Risks: DeFi relies heavily on composable smart contracts. Blacklisting asymmetry could create cascading failures across the ecosystem if blacklisted addresses interact with DeFi protocols.
Blacklisted Collateral in Vaults: Vaults accepting blacklisted USDC as collateral could create situations where the vault holds unusable funds, impacting their ability to meet obligations.
Blacklisting Arbitrage.
Native USDC on Linea:
Implementing blacklisting symmetry on Linea and between Linea and Ethereum can significantly reduce attack vectors if native USDC is introduced.
However, native USDC exists on 16 other chains (https://www.circle.com/en/usdc), with potentially inconsistent blacklisting policies, creating a significant cross-chain security attack surface.
This could additionally lead to:
Risk-free Trades: Possibility of creating risk-free trades with perpetuals, avoiding liquidations, and reverting transactions within Lender and Perpetual protocols.
Cross-Chain Attack Vectors: Potential for cross-chain attack vectors arising from the asymmetry between different layer-2s.
Legal Issues: Blacklisted addresses by USDC on mainnet should not be able to operate freely using USDC or USDC.e on Linea.
Recommendations and Conclusion
Recommendations:
Proactive Blacklisting Integration: Linea should prioritize integrating a layer-2 specific blacklist mechanism that synchronizes frequently with the mainnet USDC blacklist. This minimizes delays and inconsistencies that create attack vectors.
Security Audits and Transparency: Conduct thorough security audits of Linea's USDC.e implementation and related smart contracts. Publicly disclose audit reports to assure users of the platform's security posture.
Engage with Circle and Layer-2 Community: Collaborate with Circle to discuss potential solutions for achieving blacklisting symmetry across Linea and other layer-2 deployments. Additionally, engage in discussions with the broader layer-2 community to explore standardized approaches to USDC blacklisting.
Develop Decentralized Blacklist Oracles (Long-Term): While theoretical at this point, explore the feasibility of developing decentralized oracles to verify blacklist status across layers. This would reduce reliance on centralized entities for blacklist control.
Educate Developers and Users: Linea should provide clear and comprehensive documentation outlining the potential risks associated with USDC, USDC.e and blacklisting asymmetry. Additionally, educate developers on best practices for building secure smart contracts within Linea's inherently asymmetric financial ecosystem.
Conclusion:
Blacklisting asymmetry presents a significant security risk for Linea and other layer-2 deployments of USDC. By proactively addressing this issue through the implementation of the recommendations outlined above, Linea can foster a more secure and robust ecosystem for its users.