Symbiosis BridgeV2 — signed receive mints unbounded syBTC (BSC)

Source & credit. Crypto Training original detection and analysis (live Twitter/X security-alert intake — not from DeFiHackLabs). Standalone Foundry PoC, offline anvil_state.json, and full write-up: 2026-09-SymbiosisBridgeV2SyBtc_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/bridge/missing-validation · vuln/logic/missing-validation · vuln/input-validation/missing · vuln/auth/signature-validation

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder. Full verbose trace: output.txt. Source test: test/SymbiosisBridgeV2SyBtc_exp.sol. Verified sources: BridgeV2.sol (signed receive + unconstrained transmitter call), Synthesis.sol (metaMintSyntheticTokenBTC 1:1 mint), SyntFabric.sol, SyntERC20.sol (syBTC).

Key info#

TL;DR#

Symbiosis BridgeV2 treats an MPC signature as sufficient to mint synthetic BTC.

receiveRequestV2Signed(callData, receiveSide, signature) checks SignatureChecker.isValidSignatureNow(mpc(), getRequestHash(...), signature) and then does _receiveSide.call(_callData) with no amount bound. The live payload is Synthesis.metaMintSyntheticTokenBTC with amount = 2^62 + 330, serial = 7923, to = the attacker EOA. Fabric mints that many 8-decimal syBTC and transfers them to to.

The hash does not bind msg.sender, so any account that holds the signature can submit it before externalID / serial is consumed. The on-chain contracts never see a BTC inclusion proof or a max-mint ceiling.

This PoC replays the BSC mint (the smart-contract bug). The later Ethereum Uni V4 dump of ~4.39 WBTC is the cash-out, not reproduced here.

Background#

Symbiosis synthesizes BTC as syBTC on BSC. The intended path is: BTC lock on the origin side → MPC signs a receiveRequestV2 payload → BridgeV2 calls Synthesis → Fabric mints the synthetic representation.

getRequestHash is:

keccak256(bytes.concat(
    "receiveRequestV2",
    _callData,
    bytes20(_receiveSide),
    bytes32(block.chainid),
    bytes20(address(this))
));

That binds calldata, the transmitter, chain id, and this bridge. It does not bind:

• a protocol-level amount cap
• a BTC transaction / inclusion proof
• msg.sender (anyone can broadcast a captured signature)
• a dedicated consumed-hash nonce (only the inner externalID mapping)

Synthesis.metaMintSyntheticTokenBTC is onlyBridge and checks that realToMintSerialBTC[tokenReal] == serial, then increments. The serial lives inside the signed struct, so a signature over a huge amount at the next serial is enough.

The vulnerable code#

BridgeV2.sol (impl 0x291A42bD…):

function getRequestHash(bytes memory _callData, address _receiveSide) external view returns (bytes32) {
    return keccak256(bytes.concat(
        "receiveRequestV2", _callData, bytes20(_receiveSide),
        bytes32(block.chainid), bytes20(address(this))
    ));
}

function receiveRequestV2Signed(bytes memory _callData, address _receiveSide, bytes memory signature)
    external
    onlySignedByMPC(this.getRequestHash(_callData, _receiveSide), signature)
{
    _processRequest(_callData, _receiveSide);
}

function _processRequest(bytes memory _callData, address _receiveSide) private {
    require(isTransmitter[_receiveSide], "BridgeV2: untrusted transmitter");
    (bool success, bytes memory data) = _receiveSide.call(_callData);
    if (!success) {
        revert(RevertMessageParser.getRevertMessage(data, "BridgeV2: call failed"));
    }
}

Synthesis.sol (impl 0x24f6f8Ee…):

function metaMintSyntheticTokenBTC(
    MetaRouteStructs.MetaMintTransactionBTC memory _metaMintTransaction
) external onlyBridge whenNotPaused {
    require(synthesizeStates[_metaMintTransaction.externalID] == SynthesizeState.Default, "...");
    synthesizeStates[_metaMintTransaction.externalID] = SynthesizeState.Synthesized;
    // ...
    require(realToMintSerialBTC[_metaMintTransaction.tokenReal] == _metaMintTransaction.serial, "Symb: nonsequential mint serial");
    realToMintSerialBTC[_metaMintTransaction.tokenReal] = realToMintSerialBTC[_metaMintTransaction.tokenReal].inc();

    ISyntFabric(fabric).synthesize(
        address(this),
        _metaMintTransaction.amount - _metaMintTransaction.stableBridgingFee,
        syntReprAddr
    );
    // fee mint to bridge, then TransferHelper.safeTransfer(syntReprAddr, to, amount)
}

SyntFabric.synthesize is SyntERC20(_stoken).mint(_to, _amount) with no cap.

Live inner values (from test/SymbiosisBridgeV2SyBtc_exp.sol):

Root cause#

1. MPC signature is the only mint gate. There is no on-chain amount ceiling, no BTC proof, and no sanity bound versus 2^62-scale values.
2. Unconstrained .call(_callData) to any transmitter (Synthesis is one). The bridge does not decode or bound the inner amount.
3. Request hash omits msg.sender. A captured signature is submittable by any EOA until externalID is marked Synthesized.
4. Serial is attacker/MPC-chosen inside the signed struct, not an independent on-chain nonce the signer cannot pick.
5. 1:1 synt mint (SyntFabric.synthesize → SyntERC20.mint) with 8 decimals turns a single bad signature into tens of billions of face syBTC, which can then be bridged / swapped (the Ethereum WBTC dump).

Preconditions#

• BridgeV2 not paused; Synthesis is a registered transmitter; isTransmitter[Synthesis] == true.
• realToMintSerialBTC[tokenReal] == 7923 (the next serial in the signed payload).
• synthesizeStates[externalID] == Default (this externalID unused).
• A valid MPC ECDSA over getRequestHash(innerCalldata, Synthesis).
• syBTC representation exists for tokenReal.

Attack walkthrough#

From output.txt:

MPC: 0x855eeeAe34D08597Db031094efbd8B6D15f849f6
mint serial before: 7923
Minted syBTC (8 decimals): 46116860184.27388234
minted raw: 4611686018427388234
[PASS] testExploit() (gas: 421364)

Cash-out (not in this PoC): the attacker dumped ~4.39 WBTC on Ethereum Uniswap V4 for ~$336k realized.

Diagrams#

Remediation#

1. Cap mint amounts on-chain (absolute and per-serial). Reject amount above a BTC-realistic ceiling.
2. Require a BTC inclusion proof (or a light-client / attested lock event) — an MPC signature must not be sufficient to print synthetic BTC.
3. Bind msg.sender (or a dedicated relayer set) and a consumed request hash independent of caller-chosen externalID.
4. Decode inner calldata in the bridge and bound amount / to / tokenReal before .call.
5. Circuit-break when minted face value diverges from observed BTC locks.

How to reproduce#

_shared/run_poc.sh 2026-09-SymbiosisBridgeV2SyBtc_exp --mt testExploit -vvvvv

Expected: [PASS] testExploit() minting 4611686018427388234 raw syBTC (8 decimals).

Reference: https://x.com/blockaid_/status/2098275381417513149

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-09-SymbiosisBridgeV2SyBtc_exp (evm-hack-registry mirror).
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.