What happened
On February 5, 2022, an attacker exploited the Meter Passport bridge, minting unbacked BNB and wETH and draining the bridge's reserves. The attacker dumped the bridged BNB (BNB.bsc) on SushiSwap on Moonriver, crashing its local price by about 77%.
Hundred Finance's Moonriver markets still valued BNB.bsc collateral at the global Chainlink BNB price. Other accounts bought the discounted token, posted it as collateral and borrowed ETH, MIM and FRAX worth more than the collateral was really worth. Hundred asked four accounts to return the funds voluntarily. Two did, and the ETH loan was fully repaid, but about $3.3 million of MIM and FRAX debt remained outstanding. Hundred delayed reopening those markets by about a day and its founder vfat promised stricter bridge policies and monitoring. Meter accepted responsibility and said it would reimburse losses in its native token where it could.
BNB.bsc dump transactions on Moonriver:
0x14dc9ed2bd8f2e6e2aef00d82001eccdc07037373adb6de7f14e5e45469be504
0x4afa30ee32b139918b02aa0932b89ca3d27d71e08bcb243cd508c48848ab63bf
0x5a87c24d0665c8f67958099d1ad22e39a03aa08d47d00b7276b8d42294ee0591
0x9d6623969cf711a8327c7e966568870b583c0b9b900173e5f6a5746196cf966d
0x4e2a54f3b3035573ffdafecdf7cd7837b6672d498bf3a560a4f8dd57322a2156
0xbe0610f89e1b1a705d2524016f3b577293f51911d08a56a0149a37fb57f601ad
How it happened
- Meter's bridge handler had an alternate deposit path that did not validate the amount in calldata, so the attacker minted BNB and wETH without depositing real assets.
- The attacker sold the unbacked
BNB.bscon SushiSwap on Moonriver, crashing its local price about 77%. - Other accounts bought cheap
BNB.bscand supplied it to Hundred Finance, which priced it at the global Chainlink BNB price. - Those accounts borrowed ETH, MIM and FRAX against the inflated collateral. Two of four returned funds, leaving about $3.3M of MIM and FRAX bad debt.
Protocol details
Security review history
- Chainsulting View report
Evidence
- report Meter - REKT rekt.news
- transaction Moonriver transaction 0x14dc9ed2...be504 (Subscan) moonriver.subscan.io
- transaction moonriver.moonscan.io transaction 0x14dc…e504 moonriver.moonscan.io
- transaction moonriver.moonscan.io transaction 0x4afa…63bf moonriver.moonscan.io
- transaction moonriver.moonscan.io transaction 0x4e2a…2156 moonriver.moonscan.io
- transaction moonriver.moonscan.io transaction 0x5a87…0591 moonriver.moonscan.io
- transaction moonriver.moonscan.io transaction 0x9d66…966d moonriver.moonscan.io
- transaction moonriver.moonscan.io transaction 0xbe06…01ad moonriver.moonscan.io
- analysis Latest DeFi bridge exploit results in $4.4M losses for Meter cointelegraph.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
