Offchain Labs publicly disclosed that it had discovered two serious vulnerabilities in OP Stack fraud proofs

PANews reported on April 26 that Arbitrum's R&D team Offchain Labs reported two serious security vulnerabilities found on the Optimism testnet to the OP Labs team on March 22. These vulnerabilities exist in the Optimism fraud proof system deployed by OP Labs. Offchain Labs provided demonstrative attack code to help OP Labs identify and understand these security issues. On March 25, OP Labs confirmed the existence of these problems and coordinated the disclosure time of the vulnerabilities with Offchain Labs.

According to the agreement between the two parties, Offchain Labs will not publicly disclose the vulnerabilities until the problems are fixed. The Optimism testnet was updated on April 25, and then Offchain Labs publicly disclosed these security vulnerabilities for the first time today. These vulnerabilities allow malicious parties to manipulate the OP Stack's fraud proof mechanism to accept false chain history or prevent it from accepting the correct chain history. The problem stems from a vulnerability in the OP fraud proof design in handling timers.