Another DeFi-related project by the name of MeterIO was hacked, facing a loss of $4.3 million, which could be worth more by press time due to increased volatility on the cryptocurrency market. Hackers stole 1,391 ETH and 2.7 BTC.
Technical explanation of the hack
Meter pretty well replicates the technology of ChainSwap cross-chain hub, or is simply a fork of it. But the main difference introduced by Meter developers is the change in the deposit method of the ERC20 handler.
The change assumes that the bridged token, which is a wrapped Native token, will not be burned or locked since the wrapped Native token is already unwrapped. The mentioned line of the code assumes that the bridged token is a wrapped Native token, so that it should not be burned or locked.
The @Meter_IO is hacked with the loss of $~4.3M (including 1391.24945169 ETH + 2.74068396 BTC). The extension over the original (unaffected) ChainBridge introduces a false deposit issue !!! https://t.co/YShfXnEZzD pic.twitter.com/oY6bpau8DA
— PeckShield Inc. (@peckshield) February 6, 2022
The assumption would have worked as intended for only one of the deposit methods, but it does not function properly for another method of putting funds in the contract on WETH deposit address.
The hacker has noticed the inconvenience in the contract and has sent the needed amount in calldata and taken control of funds that he or she should not have had.
Cross-chain bridges are suffering
Meter's case is not the first one in the cross-chain industry with one of the largest Solana-Ethereum bridges facing a vulnerability that leads to a loss of $320 worth of cryptocurrency.
Reportedly, the Wormhole's issues were tied to the underlying bug in Solana's core, which has been fixed in version 1.9. But since some contracts were running on older versions of the network, hackers were able to exploit the bug and steal users' funds, which were later refunded by investors at a 1:1 rate.
Alex Dovbnya
Denys Serhiichuk
Gamza Khanzadaev