Cowrie Research

chainswap-factory-invalid-address-quota-bypass-unbacked-mapping-token-mint-drain-2021-07-11

14 min read

ChainSwap Factory Invalid-Address Quota Bypass / Unbacked Mapping-Token Mint Drain (2021-07-11)

  • Name: ChainSwap factory invalid-address quota bypass / unbacked mapping-token mint drain
  • Date: 2021-07-11
  • Protocol: ChainSwap
  • Chain: Ethereum + BNB Chain
  • Category: bridge verification failure / quota-bypass / unbacked mapping-token mint
  • Loss: about 4.4M across 20 bridged assets, depending on whether the source follows ChainSwap’s own $4M figure or contemporaneous coverage rounding closer to $4.4M
  • Summary: ChainSwap’s July 2021 second exploit was not a stolen-multisig story. It was a bridge-truth failure inside the per-token proxy Factory / mapping-token mint path itself. REKT’s reconstruction said each token to be bridged had its own proxy Factory contract on Ethereum, and the attacker could call the vulnerable receive-style mint path directly. ChainSwap said the broken logic was its token cross-chain quota system: bridge mint capacity was supposed to be increased only by trusted signature-node activity, but a logic flaw let invalid non-whitelisted addresses increase that amount anyway. Public exploit reconstructions described the attacker repeatedly calling the factory mint path, paying the fixed 0.005 ETH fee, choosing a recipient address, and rotating fresh addresses to dodge the intended auth or quota restriction each time. That let the attacker mint bridge-issued mapping tokens without proving any corresponding source-side lock or burn, aggregate the counterfeit inventory, and dump it into live liquidity. The sharp preserved lesson is that ChainSwap let a bridge-local quota update become equivalent to real cross-chain custody proof.
  • Trigger / entry point:
    • ChainSwap used per-token proxy Factory / mapping-token contracts in its bridge stack, with public incident reconstructions describing a directly reachable receive mint path on the factory side.
    • The affected contract family relied on an automatically increased cross-chain quota tied to trusted signature-node behavior.
    • ChainSwap’s own postmortem said the bug sat in the token cross-chain quota code and allowed invalid addresses that were not whitelisted to increase the amount.
    • Public reconstructions described the attacker reaching the factory mint path directly, paying the fixed 0.005 ETH charge, setting the destination recipient, and repeating the flow with fresh addresses / fresh signature identities to dodge the intended auth check.
  • Root cause:
    • ChainSwap’s destination-side mint authority was no longer strictly tied to source-side custody evidence.
    • Instead, the bridge trusted a local quota / authorization path that was supposed to be reachable only through whitelisted signature-node behavior.
    • A logic flaw let invalid addresses trigger that quota increase anyway, so the factory treated attacker-authored calls as if they carried legitimate bridge mint authority.
    • The bridge therefore authenticated quota update plus fee paid strongly enough to mint wrapped supply, even though no corresponding lock or burn had been proven on the source side.
    • Address rotation then neutralized whatever per-address or per-signer friction the design expected to limit repeated minting.
  • Exploit path:
    1. The attacker identified that ChainSwap’s per-token factory contracts exposed a mint path whose amount / quota was supposed to be increased only for trusted signature-node activity.
    2. They found that the quota logic accepted invalid, non-whitelisted addresses because of a flaw in the authorization path.
    3. They called the vulnerable factory receive path repeatedly, paying the fixed 0.005 ETH charge each time and specifying recipient addresses of their choice.
    4. By using fresh addresses across calls, they bypassed the intended address-based auth or quota friction; REKT summarized this as dodge the sloppy auth check system using a new address as signature each tx.
    5. The factories minted unbacked mapping tokens across many bridged assets because the bridge treated the flawed quota increase as sufficient mint authority.
    6. The attacker re-aggregated the counterfeit inventory and sold it into live liquidity pools, with Wilder World’s WILD token given as one public example: one cited BSC transaction minted 500,000 WILD, and the attacker reportedly repeated that flow 40 times for 20M WILD before dumping into PancakeSwap.
    7. The exploit eventually touched 20 assets with an aggregate reported loss around 4.4M.
  • What the attacker needed to be true:
    • The factory / mapping-token mint path had to remain directly reachable from attacker-controlled addresses.
    • The token cross-chain quota logic had to treat some invalid, non-whitelisted addresses as if they were allowed to increase mintable amount.
    • The bridge had to accept that quota increase as enough authority to mint destination-side bridge supply without a fresh proof of source-side lock or burn.
    • Address rotation had to defeat whatever per-address restriction or anti-abuse friction the system relied on.
    • Minted mapping tokens had to have live secondary-market liquidity so the counterfeit supply could be converted into deeper assets.
  • Technical anatomy worth remembering:
    • This was a bridge-verification failure even though the public writeups did not center on forged signatures or stolen validator keys. The failed verifier was ChainSwap’s own quota-authority logic.
    • The key bridge mistake was allowing a bridge-local control variable — automatically increased mint quota — to stand in for the stronger fact the bridge should actually have required: one exact source-side lock or burn event for one exact destination-side mint.
    • The fixed 0.005 ETH fee is worth preserving because it shows how small the remaining cost of mint authority had become. Once the auth boundary collapsed, the attacker was effectively buying counterfeit bridge supply at a tiny per-call toll.
    • Fresh-address rotation mattered because it shows the protocol was relying on shallow caller-shape assumptions rather than on a source-custody proof that stayed valid regardless of which externally owned account submitted the mint request.
    • REKT’s observation that the attacker’s Ethereum wallet showed a long series of 0.005 ETH calls is analytically useful: the exploit was industrialized into a simple repetitive mint loop rather than requiring one brittle, one-shot proof forgery.
    • The per-token factory architecture widened the blast radius. Once the auth flaw existed in the repeated factory pattern, many assets inherited the same counterfeit-mint surface.
    • The exploit also preserves a healthy design warning about decentralization by auto-quota. Saying a signature node increases quota automatically is not meaningful decentralization if the resulting quota mutation itself becomes the bridge’s real mint authority and the path to that mutation is not airtight.

Three bridge-truth promotions this incident collapsed

  1. Some bridge-local mint-capacity state existed at all
    • ChainSwap’s per-token factories already had a local token cross-chain quota / remaining amount style control surface and a fee-gated public mint path.
    • At this stage the strongest true fact was only the destination side has some local headroom bookkeeping, not this exact source-side lock or burn happened.
  2. That local headroom was promoted into canonical bridge truth for this exact mint
    • This was the decisive failure. Invalid non-whitelisted addresses could still increase the amount, so the bridge let attacker-authored quota mutation masquerade as the thing that proved fresh mapping-token supply was backed.
    • ChainSwap therefore collapsed two different questions — does local factory state say minting is currently allowed? and did one exact authenticated source-side custody event create this mint right? — into the same runtime answer.
  3. That accepted bridge truth still deserved immediate multi-asset mint-and-exit authority
    • Once the factory accepted the mutated quota state, it still minted ordinary transferable mapping tokens against live downstream liquidity.
    • The repeated 0.005 ETH mint loop showed there was very little blast-radius separation between local quota bookkeeping lied once and the attacker can keep printing inventory across many assets until operators shut the system down.
  • Representative transactions and contracts:
    • Attacked contract family referenced by ChainSwap’s postmortem: 0x06c24002f43e3AF904EeEc581734EA3A7DbF355E
    • Attacker address highlighted in public coverage: 0xEda5066780dE29D00dfb54581A707ef6F52D8113
    • Representative BSC transaction cited in incident coverage for a single 500,000 WILD mint: 0x83b4adaf73ad34c5c53aa9b805579ed74bc1391c5297201e6457cde709dff723
  • Response / mitigation:
    • ChainSwap said the bridge was taken offline after the exploit.
    • Mapping tokens were frozen, and public follow-up coverage said the team specifically froze BSC mapping-token addresses to help filter attacker holdings.
    • The team warned users not to buy affected mapping tokens, pulled liquidity, and snapshotted holders / LPs before the hack for compensation work.
    • ChainSwap coordinated compensation with affected projects, including a 1:1 ASAP replacement plan for compromised ASAP exposure and treasury-backed compensation for other losses.
    • ChainSwap also said the code would undergo major additional audits before any reopening.

Pattern tags

Why the exploit worked

  • ChainSwap let a local bridge-control surface become equivalent to real cross-chain backing. Instead of proving assets were locked or burned on the source side, the vulnerable path only had to satisfy the factory’s flawed quota / auth logic.
  • The bridge’s own postmortem is unusually blunt about the decisive bug: invalid non-whitelisted addresses could automatically increase the amount. That means the protocol’s answer to who may authorize fresh bridge supply? was already wrong before any downstream market interaction happened.
  • The fixed-fee factory interface made the broken authority easy to industrialize. Once one attacker-controlled address could reach the path, repeating it from fresh addresses turned the flaw into a scalable multi-asset mint surface.
  • The public 40 repeated WILD mints example matters because it shows the bridge had no meaningful bounded-release backstop at the factory layer. One auth bug should never have been able to turn into tens of millions of counterfeit tokens for a single asset, let alone many assets.
  • By the time the attacker sold tokens on PancakeSwap or otherwise cashed out, the decisive bridge failure had already happened. Markets were just pricing bridge-issued supply that ChainSwap itself had incorrectly declared authentic.

Detection and audit pivots

  • Treat bridge-side quota variables, mint allowances, signer-maintained ceilings, and auto-increased release limits as verification logic, not operational convenience. Ask what source-side fact they are actually substituting for.
  • For every mint or release path, ask whether the bridge is proving one exact source-side custody event or merely proving that some local admin, signer, or quota condition currently permits supply growth.
  • Review per-address rate limits and allowlists as anti-spam controls only, not as the primary authenticity boundary. If rotating EOAs defeats the design, the bridge was never verifying the real thing.
  • Diff repeated factory patterns across assets. A modest auth bug in one template often means many assets share the same counterfeit-mint surface.
  • Trace whether fee payment, nonce use, or quota bookkeeping is ever treated as if it contributes authenticity. Those controls may meter usage, but they do not prove backing.
  • Test fresh address each call directly anywhere a bridge design seems to rely on caller identity or local quota reuse for safety.

Failure-prevention checklist

  • Bind every destination-side mint to one exact source-side lock or burn proof. Bridge-local quota state should at most rate-limit an already-proven transfer, never replace the transfer proof.
  • Treat quota-increase authority as custody authority. If a signer, relayer, or helper can expand mintable amount, that path needs the same scrutiny as direct mint permissions.
  • Make whitelists and signer-authorized quota mutations explicit, typed, and narrow. Invalid or non-whitelisted addresses should fail before any amount-increase side effect occurs.
  • Design anti-abuse controls as second lines, not first lines. Per-address tracking, flat fees, and throttles should complement real source-proof verification instead of standing in for it.
  • Put hard per-asset and global release caps under every bridge mint surface so one auth bug cannot mint unlimited or near-unlimited supply in one incident window.
  • Review factory-template reuse as shared blast radius. A fix should assume every asset using the same mint logic is suspect until proven otherwise.
  • Reconcile destination-side wrapped supply against source-side locked assets continuously enough to catch counterfeit inventory before it can be dumped into public liquidity.
  • Keep bridge reopening gated on proof that the protocol has restored source-side event -> exact destination-side mint binding rather than just patching one caller-shape bug.

Audit prompts

  • What exact source-side artifact authorizes this mapping-token mint, and where is that artifact verified before any local quota or fee logic runs?
  • Can any signer-maintained quota, ceiling, or allowance increase bridge supply without simultaneously proving the exact source-side event it corresponds to?
  • If the attacker uses a fresh address for every call, which authenticity check still fails and why?
  • Are whitelists and signer-authorized amount increases validated before state changes, or can invalid addresses still influence mintable quota indirectly?
  • Does the bridge have one canonical mint path per asset, or do per-token factories duplicate delicate auth logic across many deployments?
  • What per-asset release cap would have contained the 20M WILD example, and why was that cap not already present?
  • Can fee payment, nonce advancement, or quota bookkeeping currently let a destination mint succeed without proving source-side backing?
  • If one asset’s factory logic is compromised, what exact controls stop the same bug from printing counterfeit supply across the rest of the bridge’s asset set?

Lessons that should already be standard

  • Bridge-local quotas are not bridge truth. They are at best operational limits layered on top of real proof.

  • A fee is not an authenticity check. If paying 0.005 ETH can sit one step away from mint authority, the bridge has already confused metering with verification.

  • Per-address restrictions are fragile anti-abuse glue, not a substitute for source-side custody proof. If the system breaks when the attacker rotates EOAs, the system was not verifying backing at all.

  • Factory-per-asset architectures multiply blast radius unless the shared template is extremely boring and extremely well constrained.

  • Automatic signer-node quota increase is not decentralization if that quota mutation becomes the real gate to minting and the path to mutate it is flawed.

  • Multi-asset bridge designs need bounded release at the mint surface itself. Otherwise one template bug becomes many markets’ counterfeit inventory at once.

  • Key transaction hashes:

    • Representative BSC WILD mint transaction cited in incident coverage: 0x83b4adaf73ad34c5c53aa9b805579ed74bc1391c5297201e6457cde709dff723
    • Cash-out pattern preserved by REKT: the attacker’s later Ethereum-side unwind reportedly included five 1inch transactions totaling 456 ETH.

  • Comparable exploit pattern:

Why this incident matters

  • It preserves a bridge failure mode that is easy to under-describe if we focus only on famous signer compromises or proof-forgery bugs. Bridges can also fail because an internal quota / allowance subsystem quietly becomes the real source of mint authority.
  • It is a good counterexample to vague auto-decentralized quota language. ChainSwap’s own explanation says the signature-node quota logic was intended to make the bridge more decentralized, but in practice the design let flawed local authorization outrank actual source-side custody proof.
  • It also matters as a multi-asset template lesson. The exploit hit 20 assets because the vulnerable bridge surface was reusable factory logic, not one isolated token integration.
  • The public 40 repeated WILD mints anecdote is a clean reminder that bounded release should have triggered long before secondary-market dumping made the loss irreversible.

Internal linkages

  • Parent bridge-wide framing: bridge-verification-failure.
  • More specific recurring pattern: local-mint-authority-substitution.
  • Positive-design companion: bridge-truth-security-object — useful when the sharper question is what exact source-side custody fact should have remained the one canonical object authorizing destination-side mapping-token supply.
  • Positive-design companion: bridge-headroom-provenance-and-exact-consumption-discipline — useful when the sharper question is how ChainSwap’s local quota state should have stayed provably downstream of exact source-side transfer provenance instead of becoming ambient mint authority.
  • Positive-design companion: bridge-bounded-release-design — useful when the sharper question is why one quota-auth bug was still allowed to print large amounts of multi-asset bridge inventory before containment.
  • Adjacent value-authentication companion: bridge-deposit-truth-binding — useful when the healthier follow-up becomes how the bridge should have bound mint authority to one exact lock / burn post-condition instead of to quota bookkeeping.
  • Useful contrast: unbacked qXETH mint (2022-01-27) — Qubit broke because an event and handler path no longer proved locked value, while ChainSwap broke because factory quota authority itself drifted into standing mint authority.
  • Useful contrast: unbacked BNB and WETH mint (2022-02-05) — Meter’s bridge path assumed wrapped-native custody had already happened; ChainSwap’s path assumed flawed local quota state was enough to mint.

Control surface

Graph View

Backlinks