Virtuals Protocol Fixes Critical Bug, Pledges Bug Bounty for Security Researcher
Virtuals Protocol, a blockchain firm specializing in artificial intelligence agents, has addressed a critical vulnerability in one of its audited smart contracts after it was flagged by a pseudonymous security researcher known as Jinu. The discovery prompted an urgent fix and the relaunch of the company’s bug bounty program.
The Discovery
On December 3, 2024, Jinu identified a critical flaw in Virtuals Protocol’s smart contract. Despite the contract having undergone an audit, Jinu found a lack of validation in the creation of AgentTokens, a key component of the platform. The flaw could have halted token generation until the contract was fixed.
“If exploited, this vulnerability would have prevented AgentTokens from being generated until the contract was fixed,” Jinu explained.
The researcher initially reported the issue to Virtuals Protocol via their now-closed Discord group but faced challenges due to the absence of an active bug bounty program, which meant the discovery did not qualify for an immediate reward.
Public Disclosure and Fix
Frustrated by the company’s initial response, Jinu took to X (formerly Twitter) to disclose the vulnerability. This action spurred Virtuals Protocol to verify the issue and issue an immediate patch.
In a message to Jinu, the company expressed its gratitude:
“We have verified the vulnerability and applied a patch below. Thank you for bringing this up to us, and we apologize for the miscommunication. Let us internally review the severity of the issue, and we will issue you a bug bounty shortly.”
Bug Bounty Program Relaunch
Virtuals Protocol has pledged to reward Jinu for the discovery, though the exact bounty amount is yet to be determined. The incident has prompted the company to relaunch its bug bounty program, signaling a renewed commitment to security and transparency.
Jinu’s Motivation
Jinu’s interest in Virtuals Protocol was sparked by a friend’s investment in a token created on the platform. The researcher spent just 30 minutes reviewing the code before uncovering the flaw, highlighting the importance of continuous scrutiny even for audited contracts.
“The vulnerability is simple and can impact the Virtuals ecosystem,” Jinu said.
Looking Forward
The incident underscores the critical role of white-hat hackers in maintaining blockchain security. While Virtuals Protocol quickly addressed the vulnerability, the event highlights the need for proactive bug bounty programs to incentivize security researchers and bolster trust within the ecosystem.
Stay tuned for updates as Virtuals Protocol finalizes its bug bounty reward for Jinu and continues to enhance its platform’s security infrastructure.
