CertiK phân tích cuộc tấn công vào cầu liên chuỗi Verus: Khai thác sự khác biệt ngữ nghĩa trong gốc trạng thái

The ME News report, on July 31 (UTC+8), CertiK released an analysis of the attack on the Verus protocol’s Ethereum cross-chain bridge on July 23. The analysis revealed that the root cause of the attack was a discrepancy in how Verus and Ethereum interpret notarization data. The attacker injected multiple malicious duplicate state root entries into a legitimate notarization transaction; these data entries were duly signed by 11 Verus notary nodes and relayed to Ethereum. Since the Verus side reads serialized state root data and inserts it into a mapping table, while the Ethereum side iterates sequentially through all proofRoots entries during deserialization and overwrites the state root for every entry matching the system ID, the malicious state root entries submitted later overwritten the initially legitimate state root, allowing the attacker’s manipulated state root to be accepted by Ethereum as a trusted checkpoint. On this basis, the attacker initiated an extremely small cross-chain export request of only 0.01 VRSC via Bridge.vETH on the Verus chain, then, when calling the submitImports() function on the Ethereum side, forged critical fields in the import proof—such as hashtransfers (transfer hashes)—to match the hash of the actually transferred assets, while reusing partial data from prior legitimate transactions to construct the remaining proof fields. CertiK pointed out that the Verus-Ethereum cross-chain bridge contract contained a logical vulnerability: it failed to verify whether the specified payment amount in the import request matched the actual exported amount on the Verus network, allowing this forged proof to pass validation and ultimately authorizing withdrawals far exceeding the actual amount transferred. After successfully executing the attack, the attacker used Relay to exchange the stolen assets for 2,778.8662 ETH and transferred them to Tornado Cash. (Source: Foresight News)