Qubit Finance Hack
What happened
Qubit Finance's Ethereum-to-BNB Smart Chain QBridge was exploited on January 27, 2022. The attacker induced the Ethereum bridge to emit deposit events without receiving tokens, then used the resulting unbacked qXETH as lending collateral on BNB Smart Chain to borrow real pool assets. Incident analyses put the loss at about $80 million.
A generic ERC-20 deposit path remained callable for the native ETH resource after its token mapping was changed to the zero address. Successful completion of a low-level token call was treated as proof of transfer, allowing a zero-value call to generate a bridge deposit event. Native-asset and ERC-20 routes must be mutually exclusive, and bridge messages must be tied to verified asset movement.
How it happened
Qubit had introduced a dedicated depositETH() route but left the older generic ERC-20 deposit() route reachable. For the ETH resource, its token address had been changed to address(0). The generic route's low-level transfer call to that address did not fail or move tokens, yet the route emitted the deposit event that Qubit's relayer treated as a valid bridge deposit.
The attacker made 16 such Ethereum calls, and the relayer submitted 16 corresponding BNB Smart Chain proposals that minted unbacked qXETH. The attacker supplied that qXETH as collateral and borrowed real WETH, BTCB, stablecoins, and other assets from Qubit's pools.
Protocol details
Security review history
- PeckShield View report
Evidence
Proof of concept
1 availableSources
- report Post-mortem rekt.news
- report Qubit Finance Protocol Exploit Report medium.com
- report Report archive.is
- report Qubit Finance Protocol Exploit Report 2 medium.com
- transaction Transaction etherscan.io
- transaction Transaction bscscan.com
- transaction Etherscan zero-value exploit deposit etherscan.io
- address On-chain address etherscan.io
- analysis DeFiLlama defillama.com
- analysis CertiK analysis of the Qubit bridge exploit certik.medium.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
