Virtuals Protocol Fixes Smart Contract Bug After Researcher’s Discovery

Highlights:

• A security researcher flagged a critical smart contract vulnerability in Virtuals Protocol.
• Security updates and a relaunch of a bug bounty program were prompted after the researcher’s discovery.
• The company also increased transparency by publishing the fix details on BaseScan and GitHub.

Virtuals Protocol, a blockchain firm focused on artificial intelligence agents, announced a critical vulnerability in its audited smart contract. Jinu, a pseudonymous security researcher, found the flaw and reported it quickly. However, the discovery came without immediate recognition because the company didn’t have an active bug bounty program.

I took a quick look at the code and found the vulnerability in @virtuals_io

They seem to have been audited, but when I contacted them, the team replied that they were not running a bug bounty. And they closed the discord channel I created to report the vulnerability. pic.twitter.com/W39eP6hLIX

— jinu (@lj1nu) January 3, 2025

Smart Contract Critical Vulnerability

The flaw was related to the creation of AgentToken within Virtuals Protocol’s ecosystem. Jinu found that the AgentToken.sol contract didn’t validate existing pairs on Uniswap V2. This precarious oversight could enable malicious actors to preemptively create Uniswap pairs, which would impede future token launches.

In addition, the predictable token addresses resulting from the Clones library also contributed to the problem. The vulnerability could disrupt the operations of the Virtuals Protocol if it remains unaddressed, temporarily preventing token launches. Concern about security measures in Virtuals Protocol’s infrastructure was raised by the severity of the issue.

The Company’s Response and Fix

Jinu initially criticized Virtuals Protocol for its response. Adding fuel to frustration, the company opted to close its Discord channel for reporting vulnerabilities. Afterward, Jinu complained that there was no immediate action about security.

Following the public disclosure of the issue on X, Virtuals Protocol contacted Jinu. The team immediately mitigated the issue by introducing validation steps in the AgentToken.sol contract. The update guarantees the existing pairs are scanned before creation to prevent conflicts with Uniswap V2’s factory contract.

To remain transparent, the company published details of other fixes on BaseScan and GitHub. Virtuals Protocol also reopened discussion on its bug bounty program to incentivize future security research.

Relaunch of the Bug Bounty Program

After the fix, Virtuals Protocol said it plans to relaunch its bug bounty program. It is a security initiative designed to enable more researchers to report vulnerabilities before they are exploited. Jinu was thanked by Virtuals Protocol for bringing attention to the issue itself and a reward will be given after the severity of the flaw is evaluated.

Earlier, the company acknowledged communication lapses and apologized to Jinu for the delays. Discussions about the reward for Jinu’s discovery are still ongoing. The company stated that it is assessing the impact of the vulnerability in order to make an appropriate bounty.

Thank you @lj1nu for bringing this to our attention – a patch has been pushed.

Security is of the utmost importance to us – we're working on a bug bounty program and will announce full details soon. https://t.co/O0Axqlio8h

— Virtuals Protocol (@virtuals_io) January 3, 2025

Virtuals Protocol aims to rebuild trust and avoid anything similar from happening in the future through these steps. The relaunch of the bug bounty program is a way for the company to further improve the security across its ecosystem.

In November 2024, Uniswap announced a $15.5 million bug bounty reward for the upcoming V4 core contracts. The program’s goal was to identify critical vulnerabilities before deployment. Penalties ranged from $2,000 to $15.5 million, based on severity. Issues considered high risk would earn up to $1 million while medium-risk issues would bring in $100,000.

Introducing the largest bug bounty in history 🦄

We're rewarding up to $15.5M to anyone that finds a critical vulnerability in v4 core contracts

Find a critical bug, become a millionaire 👀 pic.twitter.com/2h2bOKRLK6

— Uniswap Labs 🦄 (@Uniswap) November 26, 2024

Uniswap V4 promised reduced costs and more customizable features. Despite extensive audits and past research, the bounty ensures additional security, highlighting Uniswap’s commitment to DeFi advancements.