BlockSec: The Hyperbridge HandlerV1 contract suffered an MMR proof replay attack, resulting in a loss of approximately $242,000

Foresight News reported, according to monitoring by BlockSec, the Hyperbridge HandlerV1 contract on Ethereum suffered an MMR proof replay attack, resulting in a loss of approximately $242,000. This vulnerability allows attackers to replay previously accepted proofs and pair them with newly constructed requests, thereby performing privileged operations (such as changing admin permissions) for profit. In HandlerV1, replay protection only verifies that the request commitment (request.hash()) has not been used before. However, the proof verification process does not bind the submitted request payload to the verified proof. Due to this disconnect, valid historical proofs can be reused with different malicious requests.