Zero-Address Flaw in a Cross-Chain Bridge Lets an Attacker Drain $80M from Qubit Finance

Qubit Finance, a lending protocol on BNB Smart Chain launched by the team behind repeat-offender PancakeBunny (twice over), lost roughly $80 million to an exploit — enough to place it seventh on rekt's leaderboard.

Qubit's cross-chain collateral feature lets users lock assets on Ethereum and borrow against them on BSC through a bridge deposit function. A logic flaw in that bridge allowed the attacker to make xETH usable as collateral on BSC without ever depositing the corresponding ETH on Ethereum.

The attacker's Ethereum address had been funded via Tornado Cash shortly before the attack began, at roughly 21:30 UTC on January 27, 2022.

Qubit's own post-mortem traced the mechanism step by step: the attacker called the bridge's deposit function on Ethereum, which in turn invokes a handler contract's deposit routine. That handler is meant to require a genuine WETH transfer — if the caller doesn't actually hold WETH, the transfer should fail and the deposit should be rejected. Instead, the relevant line of code — tokenAddress.safeTransferFrom(depositer, address(this), amount); — was called with tokenAddress set to the zero address, causing safeTransferFrom to succeed regardless of whether any tokens actually moved. The deposit function therefore completed normally no matter what amount was specified. This happened because tokenAddress had originally pointed to WETH, but was later reassigned to the zero address (used to represent native ETH) once a separate depositETH function was introduced — leaving the old deposit function in place even though it should have been retired at that point. Certik's analysis pinned the root cause on the fact that safeTransferFrom() does not revert when called against the zero address.

Without ever locking a single ETH on Ethereum, the attacker's BSC address gained 77,162 qXETH — valued at roughly $185 million — to post as loan collateral on Qubit. That collateral was used to borrow WETH, BTC-B, various USD stablecoins, CAKE, BUNNY, and MDX, all of which were subsequently swapped into a total of 200,000 BNB (about $80 million), which as of reporting remained sitting in the attacker's BSC address.

According to Qubit's own documentation, the cross-chain collateral feature had been audited by Theori in December 2021. Qubit also maintains a bug bounty of up to $250,000 on Immunefi, and the team has signaled a willingness to negotiate with the attacker.

Notably, this isn't the first time rekt has dealt with this team: back in May 2021, the PancakeBunny hacker sent 100,000 DAI to rekt, which returned the funds along with a pointed reminder not to repeat the mistake — a warning that, evidently, went unheeded.