Root cause via @blockaid: an abi.encodePacked collision across dynamic-bytes fields in our bridge retry path allowed a forged retry to pass the guard check. Bug sits at the Butter contract layer. Patch, audit, and redeployment are in progress. ButterSwap remains paused until safe to resume.

🔎 Suspected root cause - TL;DR The bridge authenticates cross-chain message retries with keccak256(abi.encodePacked(...)) over four consecutive dynamic-bytes fields (initiator, from, to, swapData). abi.encodePacked has no length prefixes, so the field boundaries aren't encoded - different field allocations can pack to the identical byte string and therefore the identical keccak. The attacker: 1) Originated a real, oracle-multisig-signed MAP→ETH message to a precomputed CREATE address. Destination had no code yet → bridge cached a "NotContract" retry commitment. 2) Deployed the exploit contract at that exact address. 3) Called retryMessageIn with rearranged bytes-field boundaries that pack to the IDENTICAL 601-byte string as the planted message → same keccak → guard passes → bridge mints 10^15 MAPO (~4.8M× supply) to attacker. Not a key compromise, not a light-client bug, not a MAPO bug. Pure Solidity abi.encodePacked footgun on multiple dynamic-bytes fields.

Thanks for surfacing this. Team is aware and coordinating with external security partners on investigation and containment. The bridge between MAPO ERC-20 and mainnet MAPO is paused. More updates as soon as we have them.