The Ronin Bridge breach and the evolution of Axie Infinity

The Ronin Bridge lost 173,600 Ethereum and 25.5 million USDC in a massive security breach in March 2022. This theft, totaling over $625 million, occurred because hackers compromised five out of nine validator nodes. These nodes included four Sky Mavis validators and one node from the Axie DAO. The breach traces back to a November 2021 request where Sky Mavis asked Axie DAO for help with transaction loads, but they never revoked the allowlist access. The attackers used stolen private keys to forge withdrawals, and they completed the theft in just two transactions. A user discovered the hack after attempting to withdraw 5,000 ether from the bridge to no avail. I find the vulnerability in the gas-free RPC node, which the attacker used to obtain the signature for the Axie DAO validator, completely inexcusable for a network of this scale. The theft occurred when the attacker exploited the fact that Sky Mavis had allowed the Axie DAO to sign transactions on its behalf during a period of high user load. This $615 million loss surpassed the $611 million Poly Network hack from August 2021. The attack was socially engineered rather than a technical flaw. Chainalysis and several government agencies worked to track the stolen funds, while exchanges like Huobi and Binance monitored the stolen assets for suspicious trading.

Scaling and the move to Delegated Proof of Stake

Sky Mavis built the Ronin sidechain to bypass the high fees and slow speeds of the Ethereum network. The network transitioned from Proof of Authority to Delegated Proof of Stake in March 2023 to improve decentralization. Anyone holding enough RON can now become a validator, which widens access to the network.

The RON token facilitates token swaps on the Katana decentralized exchange and pays for network transactions. The total supply distribution allocates 25% to rewards, 30% to community incentives, 30% to Sky Mavis, and 15% to the ecosystem fund. Token holders delegate their stakes to chosen validators to verify transactions and earn rewards. Validators must stake RON to participate, and the system uses slashing rules to penalize those who fail to produce blocks or manipulate the system. The network processes transactions in seconds, while Ethereum averages 13 seconds per block. I think the transition to Delegated Proof of Stake was a necessary reaction to the centralized risks of the original model. While the Ronin network processed 560% more transactions than Ethereum in November 2021, the security trade-offs remained evident. Will the increase to eight required signatures truly prevent another social engineering attack?

Play-to-earn economy and market growth

Axie Infinity pioneered the play-to-earn model where users earn tradable tokens like Smooth Love Potion. This model saw massive adoption in countries like the Philippines and Venezuela, where monthly earnings often exceeded the national average. The total sales for Axie Infinity reached $3.85 billion across 12.6 million transactions from 1.44 million buyers. The Ronin network saw 16x growth in a year since January 1, 2023, and the RON market cap passed $500 million by the end of 2023. You should know that the network relies on the Katana DEX to handle liquid swaps for its users.

The Ronin sidechain handles transactions quickly when Ethereum gas fees hover between 50 and 100 gwei. The network also uses the Ronin Name Service, which provides human-readable .ron domains. These domains fall into tiers based on color, such as gold, blue, or green, with regular names following a numbered tier value. Regular names with a value above $200 sit in Tier 1, while names between $50 and $200 fall into Tier 2. Auctioned domains require a 15% reservation fee on the domain price. I observe that the massive influx of users on the Ronin blockchain pressured developers to take shortcuts that compromised security. Other games such as Pixels, The Machines Arena, and Battle Bears Heroes now use the Ronin network. The Binance Pay partnership allows users to convert ETH on Binance into SLP on Ronin via a fixed fee.