# MAPProtocol: forged cross-chain message mints arbitrary MAPO

MAPProtocol OmniServiceProxy retryMessageIn accepted a forged cross-chain message, letting attacker mint 1B MAPO tokens (~$180K) to themselves.

- Payout: Real-world hack
- Severity: critical
- Program: MAPProtocol
- Credited: DeFiHackLabs
- Disclosed: 2026-05-20
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/MAPProtocol_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260520-mapprotocol
- Tags: domain:web3 impact:funds-loss impact:integrity kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** OmniServiceProxy cross-chain message handler (retryMessageIn)
**Root cause:** retryMessageIn processes an attacker-supplied message payload without adequately validating the message root/proof against a trusted source, so arbitrary mint instructions are executed.
**Steps:**
1. Fork mainnet at block 25137571.
2. Build messagePayload encoding chainId=1, nonce=10000, attacker addresses, MAPO token, and mintParams (recipient=attacker, amount=1e18*1e9, decimals=18) with a chosen MESSAGE_ROOT.
3. Call `OMNI_SERVICE_PROXY.retryMessageIn(142967269125167041077124280185344731231610710977720281833930752, 0xf2fbaa8a..., address(0), 0, hex"1ad1a4a1...", messagePayload, "")` from attacker.
4. Verify MAPO.balanceOf(attacker) increased by 1_000_000_000_000_000 ether.
**Exploitation:** Attacker directly invoked retryMessageIn on the OmniServiceProxy with a crafted message payload and arbitrary message root, bypassing cross-chain verification, causing the bridge to mint 1e15 MAPO to the attacker's address; tokens then sold for ~$180K.
**Insight:** Cross-chain 'retry' entrypoints that accept a caller-supplied message root/proof are prime targets: check whether the root is validated against a stored/committed value or trusted blindly, and whether the message decoder lets you set arbitrary mint recipients.