Symbiosis has published its post-mortem on the Bitcoin Bridge incident of 11 September. The deposit that set the whole thing off was a real Bitcoin payment worth about 25 cents. The bridge reads deposit instructions from data attached to Bitcoin transactions, and its decoder "identified the sender using the wrong part of that data: a part the spender controls." That was enough to have the attacker treated as an approved depositor and as the bridge administrator at the same time. With that, they put the minimum fee below zero, and a second bug subtracted the negative fee — which added to the deposit instead of reducing it. Twelve deposits went through across BNB Chain, Ethereum and Rootstock in roughly four minutes. That first payment did not have to be forged. It was real and it was confirmed on Bitcoin. A check asking whether the deposit had happened would have answered yes, and it would have been right. The bridge was asking a second question at the same time: who sent it. For that, it read a field — one the sender controlled. Establishing a sender by signature and establishing one by reading the transaction data end in the same place: a name the system is about to act on. They differ in where the name comes from. A signature asks for something nobody can produce without the key the system already ties to that depositor. Reading it out of the deposit data makes the answer depend on which part gets read, and on that part being beyond the sender's reach. Symbiosis puts preliminary losses to liquidity providers and affected users at 9.97 BTC. The bridge is offline, and it has commissioned independent audits. Sources: https://t.co/YxSokEsot2 #DeepSafe #Web3Security #CrossChain