zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root

Teaser from the source

An attacker drained about $779K to $786K in ETH and 11 ERC-20 tokens (mostly pufETH) from zkLink Nova's Ethereum escrow and ERC-20 bridge in a single transaction on Oct 28 at 22:21 UTC. Blockaid says the attacker used a public relayer to inject a forged batch root and then finalized withdrawals to addresses they chose. SlowMist traces the root cause to the Arbitrator contract's claimMessage function, which did not clear a stored message hash or require a fresh authenticated callback, letting the publicly callable SyncL2TxHashRelayer make ZkLink.syncBatchRoot run as the legitimate Ethereum gateway. Blockaid called the attack ongoing and the main escrow still showed as unpaused hours later. At 09:06 UTC on Oct 29 zkLink confirmed an ongoing exploit targeting zkLink Nova's Arbitrator contract on Ethereum and Optimism and said its team was working to contain it. At 13:08 UTC zkLink said it had suspended block production on zkLink Nova, emergency-patched the affected contracts and temporarily disabled withdrawals.

This is the RSS-feed teaser. Read the full article at the original source.