GoPlus Security 🚦(@GoPlusSecurity):1/4 ⚠️ Exploit Breakdown: zkLink Nova Ethereum Bridge Attack On October 29, an attacker withdrew 22.43129453 ETH and 11 different ERC-20 tokens from zkLink Nova’s L1 custody contracts in a single transaction. The stolen assets were worth approximately $797,016.48 at the time of the attack. 🔍 Root Cause: The vulnerability was in zkLink Nova’s `Arbitrator.claimMessage`. The function uses `finalizeMessageHash` in transient storage to record the hash of a message just authenticated through a callback from the source chain’s canonical message service. The value was not cleared after the call. The function also did not require a fresh authentication callback for every call, allowing an already-authenticated message to be reused.

2026.10.30 08:46

1/4 ⚠️ Exploit Breakdown: zkLink Nova Ethereum Bridge Attack On October 29, an attacker withdrew 22.43129453 ETH and 11 different ERC-20 tokens from zkLink Nova’s L1 custody contracts in a single transaction. The stolen assets were worth approximately $797,016.48 at the time of the attack. 🔍 Root Cause: The vulnerability was in zkLink Nova’s `Arbitrator.claimMessage`. The function uses `finalizeMessageHash` in transient storage to record the hash of a message just authenticated through a callback from the source chain’s canonical message service. The value was not cleared after the call. The function also did not require a fresh authentication callback for every call, allowing an already-authenticated message to be reused.