# Threshold Transaction Malleability Bugfix Review

tBTC's SPV proof verifier accepted forged Merkle proofs via a 64-byte coinbase transaction, letting a malicious miner fake arbitrary Bitcoin deposits to mint tBTC.

- Payout: $50,000
- Severity: critical
- Program: Threshold tBTC
- Credited: Kayaba
- Disclosed: 2024-08-15
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/threshold-transaction-malleability/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-threshold-transaction-malleability
- Tags: domain:web3 impact:funds-loss impact:integrity kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:signature-replay

**Target:** tBTC bridge SPV proof verifier (ValidateSPV library / Solidity bridge contract)
**Root cause:** Bitcoin Merkle trees lack a transaction count in the header, so a 64-byte transaction can be reinterpreted as an intermediate node; the verifier did not check coinbase proof length or validate the coinbase proof, allowing a crafted 64-byte coinbase to collide with a fake transaction hash.
**Steps:**
1. Mine a block containing a valid 64-byte coinbase transaction whose last 32 bytes are controllable
2. Brute-force the unconstrained bytes so the coinbase's second half collides with the 32-byte ID of a fake transaction F
3. Submit an SPV proof to the tBTC bridge treating the coinbase as an intermediate Merkle node leading to F
4. Bridge accepts F as included in the block and mints tBTC against the fake deposit
**How found:** Researcher reasoned about Bitcoin Merkle tree construction: since headers omit transaction count, a 64-byte transaction H(T) equals H(T1.T2), so the last 32 controllable bytes can be brute-forced to collide with a fake transaction, making it appear as an intermediate node. Team's initial mitigation (rejecting 64-byte non-coinbase txs) was bypassed via coinbase transactions.
**Exploitation:** A malicious miner crafts a 64-byte coinbase transaction, brute-forces its controllable trailing 32 bytes to match a fake transaction's hash, then submits a forged SPV proof to the tBTC bridge to have the fake transaction accepted as a real Bitcoin deposit, minting tBTC.
**Insight:** When auditing SPV/Merkle proof verifiers, check whether the verifier enforces proof-length equality across leaves and validates the coinbase proof; a 64-byte leaf can be reinterpreted as an internal node, and coinbase transactions bypass length-based mitigations.