Full Report
Sony (not that Sony) has an L2 blockchain built on the Optimism Stack. They attempted to block unapproved tokens at the sequencer level. Their policy? If they don't like your contract, you get a "forbidden" response. No questions asked. This is a direct violation in the purpose of blockchain! Early traders on the blockchain got rekt when Sony blocked transactions. If you can't execute a transaction when trading, then you're going to lose money. Damn, this is bad... The Optimism Stack was built with this issue in mind: the sequencer can be bypassed. A transaction can be forced to the L2 by sending it through the L1, skipping the sequencer altogether. You can censor at the RPC level but you cannot sensor at this level. Blockchains are meant to be open and let others execute things. In the real world, there are rules and regulations on what is allowed though. So, a company trying to write their own rules is going to happen. Good post!
Analysis Summary
# Incident Report: Sony Soneium L2 Sequencer-Level Censorship
## Executive Summary
Sony’s Layer 2 blockchain (Soneium), built on the Optimism Stack, implemented a centralized censorship policy by blocking specific smart contract interactions at the sequencer level. This resulted in significant financial losses for early traders who were unable to execute exit positions, leading to a "soft-lock" of funds. While the blockchain's architecture allows for sequencer bypass via Layer 1, the immediate lack of accessibility caused a major operational disruption and a breach of trust regarding decentralization.
## Incident Details
- **Discovery Date:** August 2024 (Initial launch phase)
- **Incident Date:** Ongoing during early mainnet/testnet deployment
- **Affected Organization:** Sony (Soneium L2)
- **Sector:** Blockchain / Web3 / Financial Services
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Launch phase of Soneium.
- **Vector:** Governance/Policy Implementation.
- **Details:** The Soneium sequencer was configured with a "Forbidden" response policy for transactions interacting with unapproved or "disliked" contract addresses.
### Lateral Movement
- **N/A:** This was a centralized policy enforcement rather than a network intrusion. The "movement" was the propagation of the censorship filter across the sequencer nodes.
### Data Exfiltration/Impact
- **Details:** Traders attempted to execute swaps or move tokens but received HTTP/RPC "Forbidden" errors. Because users could not sell or move assets during market volatility, capital was effectively trapped, leading to "rekt" portfolios.
### Detection & Response
- **Detection:** Early traders noticed transaction failures and publicized the "Forbidden" status codes on social media (X.com).
- **Response Actions Taken:** The community identified that the Optimism Stack allows for a "sequencer bypass," forcing transactions through the Ethereum L1 (Layer 1) to circumvent the centralized block.
## Attack Methodology
*Note: In this context, the "attacker" is the centralized entity imposing restrictions on users.*
- **Initial Access:** Administrative control over the L2 Sequencer.
- **Persistence:** Hardcoded or configuration-based blacklisting of contract addresses.
- **Defense Evasion:** Attempted to mask censorship as standard RPC errors, though easily identified by the community.
- **Impact:** Denial of Service (DoS) for specific smart contract interactions, leading to financial loss.
## Impact Assessment
- **Financial:** High for affected users; unspecified total value locked (TVL) impacted by inability to trade.
- **Data Breach:** None (Privacy/Autonomy breach instead).
- **Operational:** Disruption of the intended "open" nature of the blockchain; users forced to use complex L1 bypass methods.
- **Reputational:** Significant damage to the "Soneium" brand within the crypto community due to perceived violations of decentralization principles.
## Indicators of Compromise
- **Behavioral indicators:** RPC responses returning `403 Forbidden` for valid, signed transactions.
- **Network indicators:** `https[:]//rpc[.]soneium[.]org` (Defanged) rejecting specific contract calls.
## Response Actions
- **Containment measures:** Users shifted to using direct L1-to-L2 messaging to bypass the sequencer.
- **Eradication steps:** N/A (Requires Sony to remove the sequencer-level filters).
- **Recovery actions:** Community education on how to force transactions via the Optimism Portal contract on Ethereum L1.
## Lessons Learned
- **Key takeaways:** Centralized sequencers in L2 solutions represent a single point of failure and a primary vector for censorship.
- **Infrastructure Flaws:** Relying solely on a single RPC/Sequencer allows a corporation to rewrite the "rules" of the chain at will, contrary to the ethos of Web3.
## Recommendations
- **Decentralize the Sequencer:** Implement a decentralized sequencer set to prevent any single entity from blocking transactions.
- **User Education:** Ensure users are aware of "Force Inclusion" mechanisms on L1 to bypass L2 censorship.
- **Transparency:** If regulations require blocking certain assets, implement these via front-end UIs (dApps) rather than at the protocol/sequencer level to maintain chain integrity.