Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

CCTP is the canonical USDC bridge from Circle. Allbridge is a standard bridge with an extra feature that attempts to wrap the CCTP messaging platform. CCTP has two layers: a core messaging layer (L1) and a token transfer built on top of that (L2).

Allbridge calls receiveCCTPMessage() on the core messaging layer on Circle. This verifies that the message is authenticate, and was indeed attested by Circle. So, what went wrong?

Circle's CCTP has a callback to the receipient of the message. Normally, this would have been the TokenMessenger contract that would have minted USDC. The attacker supplied a message to a different receipient, and had that get called by the core messaging layer. The Allbridge smart contract assumed that the minting occurred.

A simple fix would be to check the flow's source emitter to ensure that it was trusted. In reality, this isn't possible because the message emitter on the USDC token messenger contract varies by chain and is already stored within the token messenger. The general flow of relying on a callback's state changes is super complicated to get right, which is why this callback flow is pretty sketchy. One way to prevent this from happening would be to check the balance difference in USDC before and after to ensure this lines up.

Another interesting feature of this bug is that the recipient, source chain, source emitter, etc. were actually checked. The problem is that they were checked in the L2 payload that assumed that the token messenger sent the message. Because they didn't, these fields are completely controllable by attackers.

Allbridge has a good amount of volume on it. The loss was only $191K, but I imagine it could have been exploited on other chains for much more. Allbridge does have a bug bounty program but A) the max payout is $4K, and B) it's currently paused. I wonder whether an attacker considered reporting this?

This article is super vibed, annoyingly colorful for no reason (making it hard to understand what's important), and, verbose. I found it easier to just use ChatGPT to explain the vulnerability rather than parse it. Interesting integration bug in a bug nonetheless!