An opportunity for attack came when Wintermute gave the wrong wallet address to Optimism. The money was supposed to be held in a multi-signature wallet belonging to the Wintermute team, but the address provided by Wintermute was for a wallet on Ethereum, whereas it should have been an address on Optimism.
