SlowMist: An Analysis of the Attack on BNB Cross-Chain Bridge (Released in 2022)

According to SlowMist Zone Intelligence, on October 7, 2022, the BNB Chain’s cross-chain bridge BSC Token Hub was attacked. Hackers used the cross-chain bridge vulnerability to gain 2 million BNB in two separate transactions, worth more than $570 million. The SlowMist Security Team analyzed this event and shared the results in brief. (Note: The BSC Token Hub is a cross-chain bridge between the BNB beacon chain (BEP2) and the BNB chain (BEP20 or BSC))

Brief Analysis

1. During the cross-chain process between BNB Beacon Chain and BSC, the cross-chain contract deployed on BSC will invoke the pre-compiled 0x65 contract to perform IVAL tree verification on the submitted appHash, key, value and proof. The IAVL tree is a variant of the AVL tree which is an implementation of an AVL tree that provides verifiable roots for keys.

2. Verification is mainly carried out by IAVLValueOp and MultiStoreProofOp. IAVLValueOp first calculates the roothash through ComputeRootHash and verifies it. Once verified, the output roothash is fed to MultiStoreProofOp, which checks that the roothash obtained is the same as the roothash obtained by lightClient.

3. ComputeRootHash will recurse the hash with the leaf hash and the rest path (innernode), and then check if it matches the right of the last path node.

4. In the specific hash calculation of leafnode and innernode, we can see that the hash of the leaf and right will be calculated when the left is empty, and the hash of the leaf and left will be calculated when the right is empty. But when both left and right exist, right is ignored and the hash of leaf and left is computed, meaning roothash will not be affected by right.

5. So we know that in path, if both left and right exist, right is ignored and the hash of leaf and left is returned. In a recursive hash check, the hash is checked to see if it matches the right of the last path node. This is where the right is checked in the recursive check but is ignored in the roothash calculation. The attacker can add a hash of the leaf and innernode to the path as the right of the last path node and an empty innernode to ensure that it is verifiable. This allows malicious data to be inserted to steal funds while leaving roothash unaffected.

MistTrack Analysis

Based on MistTrack analysis, we found that the initial funding for this attack came from ChangeNOW.

The hacker address in this attack had interacted with multiple DApps, including Multichain, Venus Protocol, Alpaca Finance, Stargate, Curve, Uniswap, Trader Joe, PancakeSwap, SushiSwap, etc. In addition, the 4.8 million USDTs transferred to Ethereum by hackers have been blacklisted by Tether; 1.7 million USDTs on AVAX and 2 million USDTs on Arbitrum have been blacklisted. Due to the timely suspension of BNB Chain, more than $410 million of hackers in BSC could not be transferred. On October 8, the hackers transferred about 33,771 ETH to a new address starting with 0xFA0a3, worth about $45 million.

MistTrack will continuously monitor the movement of stolen funds.

Reference:

https://twitter.com/samczsun/status/1578167198203289600

https://twitter.com/SlowMist_Team/status/1578159110708940801

About SlowMist

SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, O3Swap, etc.

Website：
https://www.slowmist.com
Twitter：
https://twitter.com/SlowMist_Team
Github：
https://github.com/slowmist/