Meter

A cross-chain bridge exploit has again exposed how fragile bridge infrastructure remains: Meter.io's BSC-side bridge was drained of $4.4 million, and the fallout knocked another $3.3 million out of Hundred Finance, a lending protocol that depended on that same bridge. Cross-chain infrastructure now accounts for the seventh entry on rekt's running tally of bridge exploits — a pattern that keeps climbing rather than leveling off. Whether engineers will ever close these gaps for good is still an open question. The technical walkthrough below draws on analysis originally posted by @ishwinder.

01Mechanics of the breach

Roughly 6am Pacific time on February 5th marks when things went wrong. Funds began flowing out after a wallet controlled by the attacker fabricated large quantities of BNB and wETH out of thin air, pulling both tokens from the bridge's holdings. Meter's team eventually caught it and froze every bridge transaction, but only after the reserves had already been emptied.

Passport — the bridge component built by Meter — traces its lineage to ChainSafe's ChainBridge codebase, forked with a single alteration: logic inside the ERC20 Handler's deposit function was changed. According to the thread's analysis:

This change basically assumes that if the token being bridged is wrapped Native token then it doesn't burn or lock since the wrapped Native token is already unwrapped and the amount transferred to the handler contract.

The assumption holds true for one of the deposit methods depositEth which also asserts the value of amount in calldata(which will then ultimately get passed to the handler's deposit method):

But the assumption doesn't hold true for another method deposit in the same contract which is mostly unguarded.

Hacker notices this and sends an arbitrary amount in the calldata, which gets passed on the handler's deposit.

From there, the attacker funneled everything into Tornado Cash, splitting the transfer across several separate transactions inside a roughly 60-minute window.

02Hundred Finance absorbs the blowback

Because its Moonriver deployment leaned on Meter's bridge, Hundred Finance ended up $3.3 million poorer through no fault of its own contract code. The protocol laid out what happened in a tweet:

Today Hundred Finance's @MoonriverNW deployment was affected by a bridge attack on @Meter_IO that resulted in the local depreciation in the price of BNB.bsc.

Accounts were able to purchase BNB.bsc at a reduced price and use these tokens as collateral at the global Chainlink price to borrow uncompromised assets on our platform. Of these, MIM and FRAX are currently impacted.

We would like to request that owners of the accounts that did so consider returning the assets borrowed so that other users are able to access their liquidity. 1 acc. holder has already done so and we are willing to pay further bounties to the remaining 3 for doing the same.

rekt reached out to Hundred Finance founder vfat to ask what, if anything, would change internally, and to learn more about coordination with Meter toward a resolution. Here is what vfat told us:

Hello, so yes of course this is an issue we are all too aware of, each new chain / bridge we add has its own risks, and a lending protocol is a natural target for bridge attackers.

We used Meter as they were the main source of wrapped BTC on Moonriver, this combined with the native bridge and Multichain puts us at 3 bridges on that chain which is the maximum we would use. Going forward we will be stricter on this, and publish more detailed information about which bridges are used for which assets. We will also look into extra monitoring for possible attacks like this.

Meter have of course accepted responsibility for this hack and are intending to use their native token for reimbursement to the extent that they can, currently we are in the gathering addresses and amounts stage.

One interesting thing is that there were 4 opportunistic loans at Hundred in total, but the first 2 have been repaid, so there is some modicum of hope still for the other 2.

Current loss to Hundred users is $3.3M.

03Aftermath

Borrowers handing back gains from those "opportunistic loans" isn't something that happens often, which makes Meter's stance — owning the incident outright rather than deflecting blame — stand out as well. Meter has said it possesses leads on who carried out the theft and is coordinating with law enforcement.

Still, criminal activity that happens purely on-chain rarely produces real consequences off of it, so a repeat performance of this kind of attack feels inevitable. Bridges will keep getting hit, and depositors will keep absorbing losses, until whoever eventually cracks the security problem gets it right. For now, the sector remains young enough that danger and upside are still two sides of the same coin.