Blockchain security firm GoPlus said an attacker exploited zkLink Nova on Oct. 29, using a single transaction to withdraw 22.43 ETH and 11 ERC-20 tokens from the aggregated Layer 2 network’s Ethereum L1 escrow contract. Based on prices at the time of the incident, the stolen assets were worth about $797,000. GoPlus traced the issue to the Arbitrator contract’s claimMessage function, which failed to clear a temporarily stored message hash after verification. That allowed a verified message to be reused. The attacker then used the publicly callable authorized relayer SyncL2TxHashRelayer to forge an L2 batch root and carry out fraudulent withdrawals. zkLink has confirmed the attack and said it has halted block production on Nova, applied emergency fixes to the affected contracts, and temporarily shut down withdrawals. The team said a full security review will follow.
According to ChainCatcher, blockchain security firm GoPlus said an attacker exploited zkLink Nova on Oct. 29 and used a single transaction to withdraw 22.43 ETH and 11 ERC-20 tokens from the aggregated Layer 2 network’s Ethereum L1 escrow contract.
GoPlus estimated the total value of the assets at about $797,000 based on prices at the time of the attack.
The firm said the flaw came from the Arbitrator contract’s claimMessage function, which did not clear a temporarily stored message hash. As a result, a previously verified message could be reused.
Using the publicly callable authorized relayer SyncL2TxHashRelayer, the attacker forged an L2 batch root and executed fraudulent withdrawals.
zkLink has confirmed the incident. The team has halted block production on the Nova network, applied emergency patches to the affected contracts, and temporarily closed the withdrawal channel. It said a full security review will be carried out later.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
