# Bug Buster Markdown version of https://l2beat.com/layer2s/projects/bugbuster ## Summary **Warning:** This project is archived and no longer maintained. **Warning:** Critical contract references can be changed by an EOA which could result in the loss of all funds. - Total Value Secured: $116.83 (-0.05% compared to seven days ago; canonically bridged $116.83, natively minted $0.00, externally bridged $0.00; 0.00% with additional trust assumptions compared to the tokens involved and the Stage assigned to the project's canonical messaging bridge) - Type: Other - Purpose: Bug bounty - Host chain: OP Mainnet ### Risks - Sequencer failure: Self sequence (sentiment: good) - State validation: None (sentiment: bad) - Data availability: Onchain (sentiment: good) - Exit window: None (sentiment: bad) - Proposer failure: Cannot withdraw (sentiment: bad) ### About Bug Buster is an open source bug bounty platform for web3, powered by Cartesi. ## Value Secured Shown as an interactive chart or widget on [the HTML page](https://l2beat.com/layer2s/projects/bugbuster#tvs). - [TVS chart (JSON)](https://l2beat.com/api/scaling/tvs/bugbuster) - [TVS breakdown by token (JSON)](https://l2beat.com/api/scaling/tvs/bugbuster/breakdown) ## Risk summary ### Funds can be stolen if 1. an invalid state root is submitted to the system by the configured Authority, (CRITICAL) 2. the DApp owner changes the consensus implementation maliciously (CRITICAL). ### Funds can be frozen if 3. the centralized validator goes down. Users cannot produce blocks themselves and exiting the system requires new block production (CRITICAL). ### MEV can be extracted if 4. the operator exploits their centralized position and frontruns user transactions. ## Risk analysis The L3 risks depend on the individual properties of L3 and those of the host chain combined. **Warning:** Critical contract references can be changed by an EOA which could result in the loss of all funds. The risks below reflect combined L2 & L3 risks. ### Sequencer failure Self sequence (sentiment: good) In the event of a sequencer failure, users can force transactions to be included in the project's chain by sending them to L1. There can be up to a 12h delay on this operation. ### State validation None (sentiment: bad) Currently the system permits invalid state roots. More details in project overview. ### Data availability Onchain (sentiment: good) All of the data needed for proof construction is published on the base chain, which ultimately gets published on Ethereum. ### Exit window None (sentiment: bad) There is no window for users to exit in case of an unwanted upgrade since contracts are instantly upgradable. ### Proposer failure Cannot withdraw (sentiment: bad) Only the whitelisted proposers can publish state roots on L1, so in the event of failure the withdrawals are frozen. ## Stage Bug Buster is not even a Stage 0 project. **Warning:** The requirement for available node software is under review ### Stage 0 - [ ] The proof system is still under development. - [x] The project calls itself a rollup. - [x] State roots are posted to Ethereum L1. - [x] Inputs for the state transition function are posted to Ethereum L1. - [ ] (under review) A source-available node exists that can recreate the state from Ethereum L1 data. Please note that the L2BEAT team has not verified the validity of the node source code. ### Stage 1 - [ ] Principle: Compromising ≥75% of the Security Council should be the only way (other than bugs) for a rollup to indefinitely block an L2→L1 message (e.g. a withdrawal) or push an invalid L2→L1 message (e.g. an invalid withdrawal) with a <7d exit window. - [ ] Users' withdrawals can be censored by the permissioned operators. - [ ] Upgrades executed by actors with more centralized control than a Security Council provide less than 7d for users to exit if the permissioned operator is down or censoring. ### Stage 2 - [ ] Upgrades unrelated to onchain provable bugs provide less than 30d to exit. ## Data availability ### All transaction data is recorded on chain All executed transactions are submitted to an on chain smart contract. The execution of the rollup is based entirely on the submitted transactions, so anyone monitoring the contract can know the correct state of the rollup chain. **References** - [InputBox.sol#30 - Optimism Etherscan source code, addInput function](https://optimistic.etherscan.io/address/0x59b22D57D4f067708AB0c00552767405926dc768#code#F1#L30) ## State validation ### No state validation Ultimately, Cartesi DApps will use interactive fraud proofs to enforce state correctness. This feature is currently in development and the Bug Buster DApp permits invalid state roots. **Risks** - Funds can be stolen if an invalid state root is submitted to the system by the configured Authority (CRITICAL). - Funds can be stolen if the DApp owner changes the consensus implementation maliciously (CRITICAL). **References** - [Authority.sol#L48 - Optimism Etherscan source code, submitClaim function](https://optimistic.etherscan.io/address/0x4246F5b1E52Fef1C52c96a9b1B679AE818d4fb35#code#F1#L48) - [CartesiDApp.sol#L201 - Optimism Etherscan source code, migrateToConsensus function](https://optimistic.etherscan.io/address/0x3ff5c7383f614256053c3f6b86a47ba974937299#code#F1#L201) ## Updates Shown as an interactive chart or widget on [the HTML page](https://l2beat.com/layer2s/projects/bugbuster#updates). ## Operator ### The system has a centralized operator The operator is the only entity that can propose blocks. A live and trustworthy operator is vital to the health of the system. **Risks** - MEV can be extracted if the operator exploits their centralized position and frontruns user transactions. ### Users can force any transaction Because the state of the system is based on transactions submitted on the underlying host chain and anyone can submit their transactions there it allows the users to circumvent censorship by interacting with the smart contract on the host chain directly. ## Withdrawals ### Regular exit The user initiates the withdrawal by submitting a regular transaction on this chain. When the block containing that transaction is settled the funds become available for withdrawal on L1. The process of settling a block usually takes several days to complete. Finally the user submits an L1 transaction to claim the funds. **Risks** - Funds can be frozen if the centralized validator goes down. Users cannot produce blocks themselves and exiting the system requires new block production (CRITICAL). ## Permissions ### OP Mainnet #### Actors ##### BugBuster Owner Addresses: [0x7f9e54fEa7F266bcE775DbC3E34061D9407b1ed3](https://optimistic.etherscan.io/address/0x7f9e54fEa7F266bcE775DbC3E34061D9407b1ed3) Owner of the Bug Buster Cartesi DApp. Can change the consensus reference and therefore steal all funds. ##### Authority Owner Addresses: [0xD330C12e8DBD00570616D9406614106e2B3A1cf5](https://optimistic.etherscan.io/address/0xD330C12e8DBD00570616D9406614106e2B3A1cf5) Owner of the Authority contract - the current consensus implementation. Can make arbitrary claims about the current state of Bug Buster and steal all funds in the absence of fraud proofs. ## Smart contracts ### OP Mainnet #### BugBuster Addresses: [0x3FF5C7383F614256053c3F6B86A47bA974937299](https://optimistic.etherscan.io/address/0x3FF5C7383F614256053c3F6B86A47bA974937299#code) CartesiDApp instance for the Bug Buster DApp, responsible for holding assets and allowing the DApp to interact with other smart contracts. #### InputBox Addresses: [0x59b22D57D4f067708AB0c00552767405926dc768](https://optimistic.etherscan.io/address/0x59b22D57D4f067708AB0c00552767405926dc768#code) Contract that receives arbitrary blobs as inputs to Cartesi DApps. #### ERC20Portal Addresses: [0x9C21AEb2093C32DDbC53eEF24B873BDCd1aDa1DB](https://optimistic.etherscan.io/address/0x9C21AEb2093C32DDbC53eEF24B873BDCd1aDa1DB#code) Contract that allows anyone to perform transfers of ERC-20 tokens to Cartesi DApps (like e.g. Bug Buster). #### Authority Addresses: [0x4246F5b1E52Fef1C52c96a9b1B679AE818d4fb35](https://optimistic.etherscan.io/address/0x4246F5b1E52Fef1C52c96a9b1B679AE818d4fb35#code) Simple consensus model controlled by a single address, the owner. #### History Addresses: [0x04395d494624D2B6e30C0dfDB74498a2839f805d](https://optimistic.etherscan.io/address/0x04395d494624D2B6e30C0dfDB74498a2839f805d#code) Contract that stores claims for Cartesi DApps.