Oracle Manipulation Risk Report: Hyperliquid Bridge

The "Oracle Manipulation Risk Report: Hyperliquid Bridge" investigates the critical trust boundary between Ethereum Mainnet and Hyperliquid L2, the Hyperliquid Bridge. With a Total Value Locked (TVL) of $6.54 billion, the bridge is a prime target for sophisticated adversaries. The report highlights three primary oracle risks: State Root Manipulation, Relayer Collusion, and Oracle Price Staleness.

State Root Manipulation via Compromised Relayer is classified as Critical. Compromising an authorized relayer key allows an attacker to submit malicious state roots, potentially draining funds from the bridge. The current trust-minimized approach relies on a small set of relayers, which amplifies the risk if the challenge period is short.

Reorg-Based State Inconsistency poses a High risk. If a reorg occurs on the Hyperliquid L2 after a state root is submitted to Ethereum, the Ethereum contract may hold an invalid state. An attacker with influence on the L2 could force a reorg, remove a legitimate deposit, and then withdraw the same assets using a new state root. This double-spending attack relies on a finality period shorter than the maximum reorg depth of the L2.

Oracle Price Staleness in Collateral Valuation presents a Medium risk. While the bridge does not set prices, the bridged assets (USDC, ETH) are used as collateral for perpetual futures. Delays in price updates on the L2's oracle could allow attackers to exploit stale prices, leading to under-collateralized positions and subsequent liquidations or exits for profit.

The bridge should ensure the L2’s price oracle is synchronized with Ethereum’s price within a defined tolerance. Lastly, Front-Running of Bridge Transactions has a Medium severity. Attackers monitoring the Ethereum mempool can front-run large bridge transactions to manipulate asset prices, affecting the bridge's valuation.