# Hack Analysis: Binance Bridge, October 2022

IAVL Merkle proof verification ignored the right-attribute of inner nodes, letting a relayer forge a proof and mint 2M BNB (~$600M) on BSC Token Hub.

- Payout: Real-world hack
- Severity: critical
- Program: Binance BSC Token Hub
- Credited: Immunefi
- Disclosed: 2023-03-17
- Write-up quality: 9/10
- Original: https://immunefi.com/blog/bug-fix-reviews/hack-analysis-binance-bridge-october-2022/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-binance-bridge-october-2022
- Tags: domain:web3 impact:funds-loss impact:integrity kind:incident platform:immunefi sev:critical tech:evm technique:reverse-engineering technique:source-review vuln:business-logic vuln:crypto vuln:signature-replay

**Target:** BSC Token Hub cross-chain bridge / IAVL Merkle proof verifier
**Root cause:** The IAVL proof verifier computed the root hash without incorporating the user-controllable Right attribute of inner path nodes, so an attacker could substitute the hash of a malicious leaf into Right and still match the legitimate root.
**Steps:**
1. Deposit 100 BNB to become a relayer authorized to call handlePackage().
2. Craft malicious payload via craftPayload(): SYN_PACKAGE=0x00, RelayFee=0, Separator=0xf8, RLP-encoded BNB symbol, token address (address(0) for native), amount, recipient, expiry.
3. Take a legit proof from the first cross-chain tx (0x79575ff7...), unmarshal it, decode Ops[0] as IAVLValueOp.
4. Hash malicious payload with tmhash.Sum; build leaf key `000001003802` + big-endian packageSequence (17684867).
5. Append a new leaf with that key/valueHash/version and an empty PathToLeaf inner node.
6. Set `valueOp.Proof.LeftPath[1].Right = maliciousHash` so the forged leaf hashes into the existing root.
7. Marshal the modified proof; verify ComputeRootHash matches legit root `e0915953...` and VerifyItem passes.
8. Submit handlePackage() with the forged payload and proof to mint 2M BNB to attacker address.
**How found:** Researcher (Omik) analyzed the IAVL RangeProof structure and noticed the verifier only compared derivedRoot against lpath.Right without validating the Left/Right attribute pairing, making the Right field attacker-controllable; they reconstructed the exploit by mutating a legitimate proof's Right attribute.
**Exploitation:** Attacker funded a relayer (100 BNB), crafted a SYN package payload claiming a large BNB transfer, and paired it with a forged IAVL proof derived from a real historical proof by overwriting the Right attribute of an inner node with the malicious leaf hash. The bridge's verification accepted the proof, and the Token Hub released 2M BNB (~$600M) to the attacker.
**Escalation:** Attacker could have drained the entire Token Hub contract balance rather than the 2M BNB actually taken; Binance paused the bridge and added a blacklist in response.
**Insight:** When auditing Merkle/IAVL proof verifiers, check whether every field of the path node (Left, Right, Height, Version) is actually consumed in root-hash computation — any field present in the struct but not bound into the hash is a forgery primitive. Reuse a real historical proof as a template and mutate only the unbound field.