THORChain: ETH Bifrost override loop — msg.value spoofing via wrapped router

Summary #

THORChain suffered a Cross-Chain DEX / AMM / Bridge on 2021-07-16, resulting in a loss of approximately $5M.

What happened #

THORChain's ETH Bifrost bridge lost $5M when an attacker wrapped the router contract to spoof a deposit amount of 200 against a real deposit of 0, exploiting an override loop the code's own comments warned should be restricted.

Linked factors #

• RD-F-001 — causal : ★ Audit scope mismatch — exploited code outside scope [via dashboard_risk_factors/Was exploited code in audit scope?: No — ETH MCCN Bifrost was explicitly out of scope at time of hack] || ★ Audit scope mismatch — full field name [via dashboard_risk_factors/Was exploited code in audit scope?: No — ETH MCCN Bifrost was explicitly out of scope at time of hack]
• RD-F-004 — causal : Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code (ETH MCCN Bifrost)]
• RD-F-006 — causal : Audit-deploy gap (RD-F-006 time between audit and deploy) [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Yes — MCCN Bifrosts were a new deployment, never audited] || Audit-deploy gap — alternate field name [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Yes — MCCN Bifrosts were a new deployment, never audited]
• RD-F-007 — related : Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No — hacker noted explicitly in the exploit that "10% VAR bounty would have prevented this"; THORChain had paused bounty refresh for MCCN]
• RD-F-146 — related : New deploys in last 30 days — fresh attack surface [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Yes — MCCN Bifrosts were a new deployment, never audited]