# Merkle verifier accepts forged proof

Does root-hash computation consume every path-node field and enforce proof length, depth and index bounds?

_Area: Smart contract access control and control flow. Seen in 6 disclosed reports; one confirmed bounty: $50,000; latest 2026-05-17. Updated 2026-10-23._

## How it works
A Merkle/SPV verifier reconstructs a root hash from a caller-supplied path and compares it to a trusted root. The assumption that breaks: that every field of each path node is bound into the hash, and that proof shape (length, depth, index/size) is constrained. When a field is ignored or a branch is reinterpreted, an attacker substitutes a malicious leaf and still matches the legitimate root.

## Where it shows up
- Path-node structs with fields (Left, Right, Height, Version) where some are not consumed in root-hash computation [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-binance-bridge-october-2022.md).
- SPV verifiers that don't check coinbase proof length or validate the coinbase proof [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-threshold-transaction-malleability.md).
- Import verifiers rebuilding proofs from caller-supplied branch arrays, indices and sizes [E3](https://bugbountylibrary.com/r/dhl%3A20260517-verusbridge.md).
- Reimplemented verifiers whose loop bounds/invariants diverge from the upstream spec (depth caps) [E4](https://bugbountylibrary.com/r/c4%3A2024-12-unruggable-invitational%3AM-01.md).
- Fixed-size leaves (e.g. 64-byte) that can be reinterpreted as internal nodes [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-threshold-transaction-malleability.md).

## How to review
Trace the root-hash computation and confirm the invariant: every field of every path node is hashed, and proof shape is fully constrained. Specifically check:
- Each struct field is actually read into the hash; unused fields are a red flag [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-binance-bridge-october-2022.md).
- Proof length equals expected leaf/internal counts; coinbase proof validated [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-threshold-transaction-malleability.md).
- nIndex/nSize/extraHashes and branch length are cross-validated against each other [E3](https://bugbountylibrary.com/r/dhl%3A20260517-verusbridge.md).
- Depth/iteration caps match the upstream reference and spec docs [E4](https://bugbountylibrary.com/r/c4%3A2024-12-unruggable-invitational%3AM-01.md).
- Leaf vs internal-node encoding is unambiguous (no length collision) [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-threshold-transaction-malleability.md).

## Variants seen
- Ignored inner-node attribute (Right) in IAVL proof [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-binance-bridge-october-2022.md).
- 64-byte coinbase reinterpreted as intermediate node in Bitcoin SPV [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-threshold-transaction-malleability.md).
- Attacker-controlled Merkle branches in cross-chain import proof [E3](https://bugbountylibrary.com/r/dhl%3A20260517-verusbridge.md).
- Missing zkTrie depth limit in reimplemented verifier [E4](https://bugbountylibrary.com/r/c4%3A2024-12-unruggable-invitational%3AM-01.md).

## Impact and severity
Critical: forged proofs minted/drained real assets — ~$600M attempted on Binance Bridge [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-binance-bridge-october-2022.md), $11.58M drained on VerusBridge [E3](https://bugbountylibrary.com/r/dhl%3A20260517-verusbridge.md), arbitrary tBTC minting [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-threshold-transaction-malleability.md). Severity is highest when the verifier gates minting or bridge imports; worse when the trusted root is shared across many assets or the verifier is a reimplementation diverging from spec [E4](https://bugbountylibrary.com/r/c4%3A2024-12-unruggable-invitational%3AM-01.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-binance-bridge-october-2022.md
- E2: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-threshold-transaction-malleability.md
- E3: https://bugbountylibrary.com/r/dhl%3A20260517-verusbridge.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-12-unruggable-invitational%3AM-01.md