CertiK Analyzes Verus Cross-Chain Bridge Attack Incident

CertiK released an analysis on July 23 regarding the Verus protocol Ethereum cross-chain bridge attack. The analysis indicates that the attack stemmed from differences in the interpretation of notarized data between Verus and Ethereum. The attacker mixed multiple malicious duplicate state root entries into legitimate notarized transactions, which were then relayed to Ethereum after being normally signed by 11 Verus notarization nodes. On the Verus side, the serialized state root data was inserted into a mapping table for processing, while on the Ethereum side, all proofRoots entries were traversed in order during deserialization, leading to the subsequent submission of malicious state root entries overriding the legitimate state root. The state root manipulated by the attacker was ultimately accepted by Ethereum as a trusted checkpoint. The attacker initiated a cross-chain export request of 0.01 VRSC on the Verus chain via Bridge.vETH, and then forged key fields in the import proof on the Ethereum side to match the hash of the actual transferred assets. CertiK pointed out that the Verus Ethereum cross-chain bridge contract has a logical flaw, failing to verify whether the payment amount specified in the import request matches the actual export amount, allowing the forged proof to pass validation and ultimately authorizing withdrawals exceeding the actual transfer limit. After the attack was successful, the attacker exchanged the stolen assets for 2778.8662 ETH through Relay and transferred them to Tornado Cash.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.