BlockSec Phalcon has identified a vulnerability in the Hyperbridge HandlerV1 contract due to missing input validation. The VerifyProof() function fails to verify that leaf_index is less than leafCount, which can result in the MMR calculation excluding the requested commitment under certain parameters. This flaw allows attackers to forge seemingly valid cross-chain messages by decoupling the proof from the actual message.