Key points
- The alleged flaw involved rejecting a non-whitelisted token while still allowing a fake deposit.
- The researcher claims the issue could have enabled a zero-cost attack on a target-chain liquidity pool.
- A Foundry proof of concept was reportedly completed, but HackenProof closed the submission as out of scope.
Context
The source looks into a security audit of Whitechain's bridge contracts, focusing on the interaction between token-whitelist validation and deposit handling. It presents this incident as a lesson for security researchers about aligning a proof of concept with a platform's threat model, noting that the official report was not accepted for remediation.
What this means for you
Directly applicable
For you, the case highlights why bridge engineers should review token-whitelist checks, rejected-deposit behavior, and the assumptions behind a security bounty's threat model.
Who benefits: Developers and technical decision-makers can use the case to assess whether similar bridge contracts mishandle rejected tokens or invalid deposit paths.