Ronin: nine guards, but five keys are enough to take away the treasure

On March 23, 2022, two withdrawals took out 173,600 ethers and 25.5 million USDC from the Ronin Bridge, used by the Axie Infinity ecosystem. Their value is in the order of $600 million depending on the date and price selected. The intrusion was not made public until several days later.

A bridge retains assets on one network to allow them to be used on another. Ronin then relies on nine validators, five of whose signatures are enough to approve a withdrawal. The attackers gain control of five keys: four related to Sky Mavis and a fifth associated with Axie DAO.

This last validation goes through an authorization device retained after a temporary need. A facility once granted becomes a lasting weakness. The apparent separation between several guards is less protective if the same access can reach a decisive part of their permissions.

The incident is discovered when a user’s withdrawal request cannot be met. The bridge is interrupted, accesses are re-examined and the team initiates investigations. Sky Mavis then announces reinforcement measures and the resupply of the bridge to compensate the affected users.

U.S. officials attribute the theft to North Korean group Lazarus. The financial investigation follows the assets, in particular when they pass through services intended to blur the traces. Attribution and recovery efforts do not mean that all the stolen amounts have been seized.

Ronin shows why the number of signatures only tells a part of the security. It is also necessary to look at who can actually get these signatures, and what old permissions are still usable.