DOT Hacked: The Hyperbridge Exploit

On April 13, an attacker exploited Hyperbridge's cross-chain gateway on Ethereum, minting 1 billion bridged DOT tokens and dumping them for ~$237k in ETH. The exploit abused a bug in the Merkle Mountain Range proof verification library from Polytope Labs. By submitting a leaf with an out-of-bounds leaf_index (1 instead of 0 for a single-leaf tree), the attacker bypassed the early-exit path in CalculateRoot, causing the function to return proof[0] directly as the computed root. Setting proof[0] equal to the expected root made verification pass for a completely forged ChangeAssetAdmin message, granting minting privileges. Root causes include missing bounds checks on leaf_index, no fuzz testing, and untrusted caller input flowing directly into a security-critical function without validation. A one-line bounds check would have prevented the entire exploit.