zkLink Nova bridge exploited for $783,100
The zkLink Nova cross-chain bridge was exploited, resulting in a loss of $783,100. The attacker exploited a flaw in the Arbitrator contract to withdraw assets fraudulently.
The zkLink Nova cross-chain bridge, which operates on Ethereum, was exploited, leading to a loss of $783,100. The attacker took advantage of a publicly callable authorized SyncL2TxHashRelayer and a vulnerability in the Arbitrator contract, specifically a failure to clear the transient finalizeMessageHash. This allowed the attacker to first populate a valid hash and then reuse it to set an attacker-chosen l2LogsRootHashes root under the legitimate gateway identity.
As a result of this exploitation, the attacker was able to withdraw ETH and ERC20 assets using forged proofs. The incident highlights a significant flaw in the bridge's contract that allowed for unauthorized access to funds. The use of Ethereum as the underlying chain means that all transactions related to this incident can be traced on the Ethereum blockchain.
The on-chain record would reflect the addresses involved in the exploit, although specific addresses are not provided in the description. This incident underscores the importance of robust contract security measures to prevent similar exploits in the future.