zkLink Nova confirms continued cross-chain bridge attack; official offering 20% white-hat bounty
BIBIBI
AT A GLANCE
zkLink said that the Nova cross-chain bridge's related contracts were still under attack, and proposed a 20% white-hat bounty for returning the funds.
Article
zkLink Nova confirms that the cross-chain bridge has been attacked and officially offers 20%a white-hat bounty
BlockBeats reports that October 29, zkLink stated that it has confirmed that the attack targeting the Arbitrator contracts of zkLink Nova on Ethereum and Optimism is still ongoing, and that the technical team is urgently responding to contain the losses. The official team called on the attacker to stop further exploitation of contracts across all chains and return the affected funds. If the attacker cooperates in returning the funds, it will offer 20%as a white-hat bounty and will not pursue the matter further.
Previously, SlowMist issued a security alert stating that the related losses were approximately 783100 USD, with the root cause pointing to the Arbitrator contract's claimMessage failing to clear temporary finalizeMessageHash and failing to require a new authentication callback for every call. The attacker could exploit the publicly callable authorization SyncL2TxHashRelayer to inject forged batch root and withdraw the assets.
Original link https://m.theblockbeats.info/flash/374393
Key points
01
October 29, zkLink stated that the attack targeting the Arbitrator contracts of zkLink Nova on Ethereum and Optimism is still ongoing.
02
zkLink said its technical team is urgently handling the incident to contain losses.
03
The official statement called on the attacker to stop further exploitation of the cross-chain contracts and return the affected funds; cooperation in returning them may earn 20% in white-hat bounty without further prosecution.
04
SlowMist warns that the related losses are approximately 783100 USD。
05
SlowMist attributed the root cause to the Arbitrator contract's claimMessage failure to clear temporary finalizeMessageHash, and its failure to require a new authentication callback for every call.
06
SlowMist said that the attacker could inject forged SyncL2TxHashRelayer through a publicly callable authorization batch root and withdraw the assets.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This is an ongoing cross-chain bridge security incident. According to reports, the attack involved the Arbitrator contracts deployed by zkLink Nova on Ethereum and Optimism; SlowMist believes that defects in the contracts' handling of messages and authentication callbacks may have allowed the attacker to forge batch root and withdraw assets. zkLink is handling the incident and has offered a 20% bounty as a condition for negotiating the return of the funds.
Why it matters to readers
The attack is described as ongoing, meaning the losses may not yet be final. The incident involves cross-chain bridge contracts and the asset withdrawal process, directly affecting the security of the funds at risk.
If you have used the zkLink Nova cross-chain bridge, you should monitor official follow-up announcements regarding attack containment, vulnerability remediation, the scope of impact, and the handling of funds; existing reports provide no specific user action guidance.
Risks and unknowns
783100 USD This is an estimate provided by SlowMist, not the final confirmed loss.
The original text does not state whether the attack has stopped or whether the vulnerability has been fixed.
The affected addresses, asset types, and final amount of funds have not yet been disclosed.
Whether the attacker will return the funds and accept 20%The white-hat bounty remains uncertain.
It has not yet been stated whether there will be fund recovery, user compensation, or follow-up audits.
Related Developments
Loading event timeline…
Related concepts
Arbitrator contract
This term is not in the glossary yet. Browse related concepts in the glossary.
