Security Report Flags High Oracle Manipulation Risk in Hyperliquid's $6.5B Bridge

A DeFi security research team published a risk report on October 26, 2023, identifying critical vulnerabilities in the Hyperliquid Bridge, which holds over $6.54 billion in total value locked across Ethereum Mainnet and the Hyperliquid L2. The bridge's security model depends on a small set of authorized relayers to submit Merkle state roots, meaning a single compromised relayer key could allow submission of fraudulent withdrawal transactions. Researchers also noted that the bridge does not independently verify asset prices on-chain, instead trusting the L2's internal state, which introduces additional systemic risk. High-latency communication between Ethereum and Hyperliquid L2 was flagged as a further concern, as it creates windows for reorg-based manipulation if finality is not strictly enforced. The report assigned an overall risk score of 7.2 out of 10, classifying the findings as high severity and recommending a shift toward a more trustless architecture.