Forged batch root empties zkLink Nova’s Ethereum escrow

zkLink Nova’s Ethereum escrow was drained down to some 0.001 ETH on Wednesday by an attacker who used a public relayer to send a fake batch root.

Blockaid, a security company, says that the amount of ETH and ERC-20 tokens taken so far is about $786,000.

Blockaid flagged a public relayer attack at 10:24 p.m. ET

Blockaid reported the attack in a post on X at 10:24 p.m. ET on October 28. The attacker used a public relayer to inject a fake root on Ethereum and then finalized ETH and ERC-20 withdrawals from Nova’s L1 escrow to receivers of their choosing.

“~$786k drained from L1 ETH escrow and ERC20 bridge so far. Attack still ongoing,” wrote Blockaid.

Nova takes in assets from Ethereum and its Layer 2 networks and pools them. When deposits are made, they stay in contracts on their source chains and are credited on Nova through its canonical bridge.

A batch root is the hash value a bridge uses to verify messages, in this case the withdrawals that Nova approved. zkLink’s settlement design necessitates proof checks and cross-chain consistency checks prior to finalizing a batch.

Then withdrawals can proceed only after the batch root goes to connected chains. Blockaid says the forged root was injected on Ethereum through a public relayer instead.

There was a new batch root logged in the same transaction as the ETH and token withdrawals, just before them. This can be seen in the transaction logs for the attack.

A 6:21 p.m. transaction sent $778,625.84 to one recipient

The transaction happened on October 28 at 6:21 p.m. ET, a few hours before Blockaid sent the alert. It took 22.43 ETH from Nova’s Ethereum escrow and 11 ERC-20 tokens from its token bridge and sent them all to the same address.

Blockaid’s thread named two addresses that the hacker used, and listed the ERC-20 bridge as a second target contract.

The largest lot was 245.74 pufETH, which is around $613,536 at Etherscan prices. About 18,113 USDC and 3,361 USDT went out with it.

At the prices shown by Etherscan, transfers add up to $778,625.84. That figure only covers one transaction, so it’s hard to tell how much money was lost altogether.

Later, Etherscan showed that there was only about 0.001 ETH left in the hacked ETH escrow. But at 10:29 p.m. ET, the escrow’s pause flag was still not set, so it’s unclear if other controls stopped any more withdrawals.

Faked inputs hit another bridge 11 days earlier. Cryptopolitan reported that on October 17, a fake mint message was used to create 10 million unauthorized CYS tokens through Cysic’s cross-chain bridge.

The Cysic attacker sold 7.2 million of the tokens. Their wallet was used to send about $727,000 to Ethereum before the project blacklisted it.

Around $7.54 million left the Verus Ethereum bridge in July. It was the second time the bridge had lost money. In May, $11.58 million was taken away for the first time. Blockaid linked the two attacks to the same contract and import route.

What caused the May exploit was about 10 lines of missing Solidity validation in the checkCCEValues function of the bridge. The same kind of validation error led to the 2022 Wormhole and Nomad attacks.