The Optimism Foundation confirmed in a release that they sent 20 million OP tokens to the wrong multi-sig wallet despite completing two test transactions.
The Optimism Foundation has published a statement indicating that 20 million OP tokens were sent to the incorrect address for a liquidity provisioning partner. Following the revelation, the price of the OP token plunged from $1.12 on June 8 to just $0.70. The statement went like this:
“The Optimism Foundation engaged Wintermute for liquidity provisioning services … a temporary grant of 20 million OP tokens was allocated to Wintermute from the Foundation’s Partner Fund.
Wintermute provided an address to receive the borrowed tokens. The Optimism Foundation sent two separate test transactions, and upon Wintermute’s confirmation for each, sent the rest. Unfortunately, Wintermute later discovered they could not access these tokens because they had provided an address for an Ethereum (L1) multisig that they had not yet deployed to Optimism (L2).”
The exact partner Optimism had hired to assist with liquidity services was not using the product they had been hired to support. Wintermute claims to be the “world’s premier global algorithmic market maker in digital assets,” however it has committed a basic error in crypto, especially for an algorithmic market maker.
Wintermute is now “committed to buying back the tokens lost. They will monitor the address that holds these lost tokens and buy as the address sells.”
Wintermute “began a recovery operation with the purpose of deploying the L1 multisig contract to the same address on L2,” according to Optimism, and they “attempted to rectify the situation without the need to repurchase the tokens.” Optimism, on the other hand, asserts: “an attacker was able to deploy the multisig to L2 with different initialization parameters before these efforts were completed, assuming ownership of the 20m OP.”
By making that error, Wintermute effectively left 20 million OP tokens on the street for anyone to claim by sending an Optimism L2 contract to the address. As a result, referring to the new owner as a “attacker” could be interpreted as a PR ploy, casting doubt on the veracity of the “exploit” or “hack.” Since then, 1 million OP has been sold from the wallet, according to Optimism.
By taking advantage of an automated market maker’s ineptness, whomever gained access to the wallet has clearly committed an ethically dubious act. Wintermute’s subsequent remark, however, hints that the matter was more complicated than a simple smart contract implementation.
Wintermute stated:
“As we communicated the wallet address to the Optimism team, we made a serious error. We had a Gnosis safe deployed on mainnet for a while and due to an internal mistake, we’ve communicated the very same wallet as the receiving address.”