A Cross-Chain Attack Spanning One Month: Analysis of the Allbridge Hack
The message was crammed with CCTP-style knowledge. The supply area was Polygon, the vacation spot area was Base, and the declared quantity was 1,000,000 USDC, with feeExecuted set to zero and destinationCaller pointing to Allbridge’s CCTPTokenMessenger contract. The attacker set the recipient in the message header to their very own contract, set sourceSender in the message physique to the configured distant Messenger tackle, and likewise put the precomputed Router messageHash into hookData for subsequent verification.
2. After creating the malicious cross-chain message, the attacker waited for about 24 days. Because the Base Router is a forwarding router, it doesn’t usually maintain a big quantity of liquidity for an prolonged interval of time. It was not till August 19, 2026, when the Allbridge relayer had simply minted roughly 191,112 USDC from a real CCTP deposit made by one other person to the Router, that the Router’s stability reached roughly 191,156 USDC.
This stability belonged to cross-chain funds ready to be transferred to the real person. The attacker waited for this extraordinarily temporary window and started executing the formal assault transaction six seconds after the real deposit occurred.
3. The assault contract first referred to as the receiveCctpMessage operate of the CCTPTokenMessenger contract, passing in the message and signature knowledge (attestation) obtained from the Polygon transaction. Both the destinationCaller test and the sourceSender test handed, as each had been managed and constructed by the attacker. It then referred to as the receiveMessage operate of Circle’s MessageTransmitterV2 contract. In this operate, the assault contract was referred to as again primarily based on the recipient laid out in the message header. The assault contract immediately returned success with out performing the anticipated token minting operation by Circle’s TokenMessenger contract. Allbridge additionally didn’t re-confirm the Router’s stability or test whether or not the callback goal contract was Circle’s TokenMessengerV2. Instead, it immediately wrote quantity – feeExecuted into receivedMessages[messageHash], producing an inside credit score of 1,000,000 USDC.
4. Because the goal quantity constructed in the cross-chain message beforehand created by the attacker was 1,000,000 USDC, whereas the Router had solely roughly 191,156 USDC at the time, the attacker first used an Aave flash mortgage to supply 808,844 USDC to the Router, quickly bringing its stability as much as the quantity declared by the attacker in the solid message, thereby satisfying the necessities for the subsequent token switch.
5. The attacker then referred to as the Router’s receiveToken operate to course of the settlement. Based on the name parameters, the Router recalculated the hash and obtained a price equivalent to the messageHash that the attacker had beforehand calculated and constructed in the hookData. It then solely checked whether or not the receivedTokenAmount document akin to this messageHash in the CCTPTokenMessenger contract was higher than zero, treating this as proof {that a} real deposit had been acquired. Since the Router expenses a 0.1% payment, after deducting the payment, it immediately transferred the remaining 999,000 USDC to the assault contract.
Throughout the total course of, the Router solely checked whether or not the credit score existed in the CCTPTokenMessenger contract, and didn’t re-confirm whether or not this credit score corresponded to an precise on-chain receipt of property of an equal quantity.
6. After stealing 999,000 USDC, the attacker repaid Aave 808,844 USDC in principal and roughly 404.422012 USDC in flash mortgage charges. This left roughly 189,751.554381 USDC as revenue, finishing the assault. The transaction basically drained the Router’s 191,156 USDC stability. Most of the loss got here from the real cross-chain deposits that had simply arrived and had not but been transferred to customers.
Interestingly, the 1,000 USDC payment collected by the Router talked about above was later taken by different attackers who replicated the identical assault technique.
Summary
The core situation behind this assault was Allbridge’s lack of correct validation of the cross-chain message. Circle’s attestation can solely show that the message content material has not been tampered with; it can’t show that the cross-chain message really triggered a token burn or mint operation. Allbridge immediately trusted the quantity, fund supply tackle, and messageHash constructed by the attacker in the CCTPTokenMessenger message, and recorded them as redeemable balances, treating them as the precise deposit quantity.
The SlowMist safety crew recommends that undertaking groups, when fixing this situation, concurrently implement the following three boundaries:
1. The sender parameter in the message header should correspond to a trusted source-side element contract;
2. The recipient parameter in the message header have to be restricted to the Circle TokenMessengerV2 contract on the vacation spot chain;
3. A redeemable deposit document ought to solely be created after the Router’s USDC stability has really elevated in consequence of the minting operation.
For cross-chain bridge methods, the most vital precept is {that a} correctly authenticated and validated message is a vital situation for cross-chain settlement, whereas the precise receipt of property is the foundation for the Router’s ultimate cost.
About SlowMist
SlowMist is a risk intelligence agency centered on blockchain safety, established in January 2018. The agency was began by a crew with over ten years of community safety expertise to develop into a worldwide power. Our aim is to make the blockchain ecosystem as safe as doable for everybody. We are actually a famend worldwide blockchain safety agency that has labored on numerous well-known initiatives similar to HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, and so forth.
SlowMist presents a range of companies that embody however usually are not restricted to safety audits, risk data, protection deployment, safety consultants, and different security-related companies. We additionally provide AML (Anti-money laundering) software program, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and different SaaS merchandise. We have partnerships with home and worldwide corporations similar to Akamai, BitDefender, RC², TianJi Partners, IPIP, and so forth. Our intensive work in cryptocurrency crime investigations has been cited by worldwide organizations and authorities our bodies, together with the United Nations Security Council and the United Nations Office on Drugs and Crime.
By delivering a complete safety resolution personalized to particular person initiatives, we are able to determine dangers and stop them from occurring. Our crew was capable of finding and publish a number of high-risk blockchain safety flaws. By doing so, we might unfold consciousness and lift the safety requirements in the blockchain ecosystem.
