PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Binance Smart Chain Token Bridge Hack

swarm.ptsecurity.com | research | #web3 | #blockchain | #web3-security | #binance | #bridge-hack | #merkle-proof
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Anatomy of the October 2022 BSC Token Hub hack ($586M): the bridge validated cross-chain transfers via Merkle proofs over an AVL tree, and forged proof data let attackers withdraw 2 million BNB.
Published
Collected

Related coverage

blog · certik.com
CertiK Independently Verifies Sui's New Performance Benchmark
CertiK independently verified Sui’s Mainnet Tunnel performance campaign, which recorded more than 15.2 billion off-chain transactions across 7,680 tunnels at a peak of 40.68 million TPS.
blog · certik.com
Preparing for a Web3 Penetration Test: What to Expect Before, During, and After
reparing for a Web3 penetration test? Here’s what happens before, during, and after an engagement, and how to get the most value from yours.
research · aikido.dev
Graphalgo campaign spreads to Terraform providers and Go Modules
Go malware has appeared in two Terraform providers and two Go modules — the first observed abuse of Terraform providers. The Graphalgo Go port hides a hash-gated trigger with blockchain and Slack C2.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · certik.com
Inside CertiK's Independent Security Research on Besu
CertiK's chaos-engineering-style testing against a private multi-node Besu testnet uncovered five resource-exhaustion vulnerabilities, patched in Besu 26.7.1 and credited in Besu's release notes.
research · certik.com
Skill Scanning Is Not a Security Boundary
This article argues that scanning third-party OpenClaw skills (e.g. Clawhub's VirusTotal and AI review pipeline) is not a security boundary, since skills execute with full privileged-runtime access.
Back