The Million Dollars BSC Token Hub Bridge Hack Analysis

Summary

On 7th October 2022, there was an exploit affecting the native cross-chain bridge called “BSC Token Hub”. The bug is in the proof verifier of the bridge. A total of 2 million BNB was withdrawn and Binance temporarily paused BSC Network to prevent further damages. Funds taken off BSC are estimated between $100M – $110M.

Introduction to Binance Smart Chain & Token Hub Bridge

Binance Smart Chain (BSC) is a Blockchain-based network used for running applications rooted in smart contracts. BSC works in parallel with Binance’s native Binance Chain (BC), allowing users to take advantage of the rapid transaction capacity of the BC as well as the smart contract features of BSC.

• BNB Beacon Chain (previously Binance Chain) – BNB Chain Governance (Staking, Voting)

• BNB Smart Chain (BSC) (previously Binance Smart Chain) – EVM compatible, consensus layers, and with hubs to multi-chains

BSC Token Hub

BSC Token Hub is the cross-chain bridge between BNB Beacon Chain (BEP2) and BNB Chain (BEP20 or BSC). Check out the official documentation of Binance for more details.

Vulnerability Analysis & Impact

Hacker’s Address: 0x489a8756c18c0b8b24ec2a2b9ff3d4d447f79bec

1st Txn Hash: 0xebf83628ba893hd35b496121fb8201666b8e09f3cbadf0e269162baa72efe3b8b

2nd Txn Hash: 0x05356fd06ce56a9ec5b4eaf9c075abd740cae4c21eab1676440ab5cd2fe5c57a

BSC Token Hub Contract: 0x0000000000000000000000000000000000001004

Original Txn hash (with block height of 110217401) : 0x79575ff791606ef2c7d69f430d1fee1c25ef8d56275da94e6ac49c9c4cc5f433

BSC Token Hub uses a pre-compiled contract for validating IAVL(Immutable AVL) trees when performing cross-chain transaction verification. The exploiter leveraged a bug in proof verification logic adapting a legit proof for making the bridge mint 2M BNB to them.

The root cause seems to be this line:

The problem is that lpath.Right could be unused in the computation of the root hash of the tree.

To fix this, the line should change

From:

```

if !bytes.Equal(derivedRoot, lpath.Right) ...

to something like:

“`

To:

```

expectedHash := lpath.Left

if len(lpath.Left) == 0 {

expectedHash = lpath.Right }

if !bytes.Equal(derivedRoot, expectedHash) ...

“`

1. The attacker used the hash of a successfully submitted block that was made 2 years ago (specified block: 110217401) to construct a payload as a leaf node to verify the IAVL tree. Original Transaction details of this can be found here.

2. The Attacker injected a leaf node containing as Key the current packageSequence and as Value the evil payload hash (i.e. minting 1M BNB to their address). Then added an empty inner node to the leaf to satisfy the implementation proof.

3. The attacker set in the left path as Right in the hash of the leaf node just created to make the root hash equal to the successfully submitted root hash and finally constructed the withdrawal proof for the particular block and submitted the transaction.

4. After successfully submitting the transaction and receiving $1M BNB. The attacker repeated the steps again and gained an additional 1Million BNB. The total of which amounted to 2Million BNB i.e. $570 Million.

The attacker tried 17 times to mint 1M BNB but they failed 15 times and it minted only 2M BNB. The reason for this was that they had a competition with other legit transactions which front-runned the exploiter tx using the same packageSequence.

After the Exploit

A few hours after the attack, the CEO of Binance CZ announced the incident through a tweet and halted the BSC network to prevent further damage.

A few hours later, Binance fixed the Issue with the latest release v1.1.15. It blocked the flow of attackers’ funds by blacklisting the attacker’s address.

Binance Blacklisted the attacker address in the recent commit.

Attacker's Wallet

Current assets held by the attacker in different chains

The Flow of Funds

Image Source: https://twitter.com/BeosinAlert/status/1578290676793384961/photo/1

Reference / Credit

https://github.com/emilianobonassi/bsc-hack-analysis-2022-10-06

Why QuillAudits For Web3 Security?

• QuillAudits is well-equipped with tools and expertise to provide cybersecurity solutions saving the loss of hundreds of protocols in funds.

• Our team of highly skilled auditors have secured over 1M lines of code and $30B in amount.

• Over the course of multiple years, QuillAudits has been proven to be one of the top choices for protocols to get their codebases audited.

Partner with QuillAudits

• OG Program (Opportunities for Listing Managers, KOLs, Top Advisors and Investors with access to early stage Web3 projects)

• QuillAudits Partnership Programme (Venture funds, launchpads, development companies, marketing firms, web2 cybersecurity firms, web3 products)

• WAGSI Program(Claim audit credits to avail exclusive discounts on our auditing package, and additional credits for our automated web3 security infra- QuillShield)