# VerusBridge: forged import proof drains $11.58M

VerusBridge accepted a forged cross-chain import proof, letting an attacker mint/drain ~$11.58M in ETH, tBTC and USDC from the bridge.

- Payout: Real-world hack
- Severity: critical
- Program: VerusBridge
- Credited: DeFiHackLabs
- Disclosed: 2026-05-17
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/VerusBridge_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260517-verusbridge
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:signature-replay

**Target:** Ethereum bridge proxy submitImports / VerusProof import verification
**Root cause:** Insufficient validation in the import proof verification path (SubmitImports -> VerusProof.proveImports -> TokenManager.processTransactions) allowed a crafted partial transaction proof with attacker-controlled Merkle branches to be accepted as a valid cross-chain import.
**Steps:**
1. Fork mainnet at block 25118334.
2. Build a CReserveTransferImport with a crafted partialtransactionproof (3 CTXProof entries with attacker-chosen branch hashes, indices and sizes).
3. Attach CComponents with elType 1 and 4 carrying forged elVchObj payloads and matching elProof Merkle branches.
4. Call `BRIDGE.submitImports(importData)` from the attacker address.
5. Bridge routes through SubmitImports._createImports -> VerusProof.proveImports -> TokenManager.processTransactions, releasing ETH, tBTC and USDC to the attacker receiver.
**Exploitation:** Attacker submitted a single forged import to the bridge proxy; the proof verification accepted the fabricated Merkle branches and the token manager released 1625.37 ETH, 103.57 tBTC and 147,658.84 USDC to the attack receiver contract.
**Insight:** Bridge import verifiers that reconstruct Merkle proofs from caller-supplied branch arrays, indices and sizes are prime targets: check whether nIndex/nSize/extraHashes and branch length are cross-validated against the committed state root before any token release.