POPA ReconzkLink Nova's Arbitrator hacked for~$780K
zkLink Nova's Arbitrator hacked for~$780K Rootcause: The Arbitrator contract had two related flaws that the attacker combined: Uncleared transient storage of the authentication hash During a legitimate claim, an authenticated gateway callback stores finalizeMessageHash (in transient storage). The Arbitrator later checks this hash against the expected source gateway, value, and message. The contract never cleared finalizeMessageHash after use. Transient storage persists for the entire transaction, so a second claim in the same transaction could reuse the first claim’s already-set (and still-v…
The excerpt is quoted from a public Telegram channel, which owns its text.
Read the original post on Telegram