Poly Network Hack
What happened
Poly Network's cross-chain bridge was exploited on Ethereum, BNB Smart Chain, and Polygon on August 10, 2021. Contemporaneous estimates placed the transferred assets at roughly $610 million to $612 million; the figure shown here is $611 million. Poly later reported recovery of all affected user assets worth $610 million.
A user-controlled cross-chain operation could reach a privileged keeper-update function through the bridge manager's general dispatch path. Cross-chain execution must restrict callable target contracts and methods, and privileged key-management state must not be reachable through relayed user data. Poly's later changes added limits and whitelists for callable contracts and methods.
How it happened
- Poly's EthCrossChainManager accepted an insufficiently constrained cross-chain target and method, then dispatched the decoded call after normal relay verification.
- Because the manager owned the EthCrossChainData keeper registry, crafted call data could reach putCurEpochConPubKeyBytes and replace the keeper with an attacker-controlled key.
- The new keeper authority could then authorize otherwise-valid bridge messages and release assets from LockProxy custody across the affected chains.
- The failure did not rely on a leaked pre-existing keeper key.
Protocol details
Security review history
- BlockSec View report
- PeckShield View report
Funds Recovery
Recovered
$602.2M
Net Loss
$8,554,000
Evidence
Proof of concept
1 availableSources
- report Post-mortem rekt.news
- report Post-Mortem slowmist.medium.com
- report Poly Network root-cause analysis medium.com
- report Poly Network asset-recovery completion update medium.com
- transaction Transaction etherscan.io
- transaction Etherscan keeper-change transaction etherscan.io
- code Code reference github.com
- analysis Website reference breadcrumbs.app
- analysis Website reference poly.network
- analysis DeFiLlama defillama.com
- analysis SlowMist Poly Network analysis slowmist.medium.com
- analysis Chainalysis Poly Network fund-flow analysis chainalysis.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
