Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
According to Web3 security data infrastructure provider GoPlus (GPS), an attacker on Oct. 29 withdrew 22.43129453 ETH and 11 ERC-20 tokens from zkLink Nova’s L1 custody contract in a single transaction. The stolen assets were worth about $797,016.48 at the time of the attack.
GoPlus said the vulnerability was in the Arbitrator.claimMessage function, which records the hash of a message authenticated through the source chain’s official message-service callback in the temporary storage variable finalizeMessageHash. After the call, the value was not deleted and each call did not require a new authentication callback, allowing an already authenticated message to be reused.