Meter Passport Bridge Hack

Reported loss $4.4M
Ethereum
Unbacked bridge deposit

What happened

In February 2022, Meter Passport lost approximately $4.4 million after a deposit-validation flaw allowed unbacked bridge assets to be created. The failure concerned Meter's modified bridge implementation. A separate downstream loss at Hundred Finance is not included in this page's $4.4 million figure.

Technical root cause

A directly callable deposit path accepted a claimed native-token amount without enforcing the matching value transfer expected by the wrapped-native-token handler.

How it happened

The intended depositEth path checked the supplied value. The attacker instead called the alternative deposit entry point and supplied an arbitrary amount in the calldata. The handler accepted the deposit assumption without receiving matching backing, allowing the attacker to extract real assets.

Halborn also describes a separate Hundred Finance loss after discounted bridged BNB was accepted at a higher oracle valuation. Adding that downstream loss to Meter's headline would double-count distinct incident records.

The review lesson is to enforce backing checks at every reachable deposit boundary, including alternative public entry points, rather than relying on callers to use the intended wrapper.

Protocol details

Classification Bridge deposit validation
Protocol Type Cross-chain bridge
Category Bridge Hack
Affected asset / contract MTRG
Implementation language Solidity
Protocol links Website @meter_io

Evidence

Proof of concept

1 available

Sources

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes