# Optimism Infinite Money Duplication Bugfix Review

Optimism's Geth fork zeroed stateObject balance on SELFDESTRUCT without redirecting to OVM_ETH storage, letting an attacker loop selfdestruct to mint unlimited OETH.

- Payout: $2,000,042
- Severity: critical
- Program: Optimism
- Credited: Jay Freeman (Saurik)
- Disclosed: 2022-03-16
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/optimism-infinite-money-duplication-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-optimism-infinite-money-duplication-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:go technique:incomplete-fix technique:source-review vuln:business-logic

**Target:** Optimism Geth client StateDB / OVM_ETH balance handling
**Root cause:** In the Optimism Geth fork, SELFDESTRUCT set stateObject.data.Balance to zero directly instead of checking UsingOVM and redirecting the balance change to the OVM_ETH ERC-20 storage, so the native balance was never actually cleared.
**Steps:**
1. Deploy an exploit contract with an internal function calling `selfdestruct(address(this))` and another that withdraws the contract balance to the caller.
2. In the constructor, loop calling the selfdestruct function multiple times; each iteration sends balance to itself while the OVM_ETH storage balance is not zeroed, inflating it.
3. After the loop, call the withdraw function to transfer the inflated OETH to the attacker.
4. Contract is destroyed at end of transaction; repeat or cash out via DEXes/bridges.
**How found:** Saurik read the Optimism Geth fork's StateDB code and noticed the SELFDESTRUCT path set stateObject.data.Balance directly rather than routing through the UsingOVM redirect to OVM_ETH storage, breaking the invariant that native balances live in the ERC-20 contract.
**Exploitation:** Attacker inflates OETH balance via repeated selfdestruct in a single transaction, then drains DEXes and bridges assets from Optimism to Ethereum; $322.5M TVL at risk.
**Insight:** When a fork redirects balance/state operations to a shadow contract (UsingOVM), audit every code path that mutates stateObject directly—especially SELFDESTRUCT and other opcode handlers—for missing redirect checks.