Meter Passport hack — February 2022

Meter Passport, the cross-chain bridge operated by Meter.io, was exploited on 5 February 2022 beginning at 14:30 UTC. The bridge was a fork of ChainSafe's ChainBridge, modified to wrap and unwrap native gas tokens automatically. The modified ERC20 handler assumed that a token identified as a wrapped native token did not need to be burned or locked when deposited. The intended entry point, depositEth, checked that the amount declared in the calldata matched the value actually sent; the underlying generic deposit function was publicly callable and did not. The attacker called it directly with an arbitrary declared amount, causing the bridge to release or mint assets it had never received: per Meter's post-mortem, 3,632.8 BNB were taken from BNB Chain and 422.5 ETH from Ethereum, while 30,000 BNB.bsc were minted on Moonriver and 1,500 WETH.eth on Meter's own network. Meter paused the bridge by 16:00 UTC. PeckShield traced 1,391 ETH and 2.74 wBTC into Tornado Cash.

The size of the loss is reported inconsistently. Meter's post-mortem sets its own liability at $4.25 million, and it issued PASS tokens, each representing one dollar of loss, redeemable in MTRG against foundation revenue; a March 2022 governance vote switched compensation to USD terms. Contemporary reporting put the bridge drain at $4.4 million.

Selling the minted BNB on SushiSwap crashed the BNB price on Moonriver by about 77%. Separate users then bought the discounted tokens and borrowed against them on Hundred Finance, which was still pricing BNB from Chainlink. Meter's post-mortem records two users taking loans this way: the first returned the majority of the funds, while the second took 1.9 million FRAX. Meter puts the total knock-on loss at Hundred Finance at $2.135 million; Cointelegraph and Halborn put it at $3.3 million. Halborn and Cointelegraph describe the combined damage across Meter and Hundred Finance as $7.7 million.