SlowMist 分析 zkLink 跨链协议约 783K 美元攻击事件

🚨 On October 29, 2026, cross-chain protocol @zkLink_Official was exploited for approximately $783K. The SlowMist Security Team analyzed the incident and uncovered how a transient storage flaw led to forged batch roots and unauthorized withdrawals. 🧩 Attack Flow: 1️⃣ Queried totalBatchesExecuted and selected the next batch (116409) for forgery. 2️⃣ Executed a genuine Linea claim through SyncL2TxHashRelayer, writing finalizeMessageHash into transient storage. 3️⃣ Reused the stale finalizeMessageHash in a second claimMessage call, triggering an attacker-controlled call to EthereumGateway. 4️⃣ Used EthereumGateway.sendMessage to call ZkLink.syncBatchRoot, forging the batch root and advancing totalBatchesExecuted. 5️⃣ Executed 12 withdrawals against the forged root: 1 ETH and 11 ERC-20 transfers using forged Merkle proofs. ⚙️ Root Cause: Arbitrator.claimMessage allows relayers to specify arbitrary call targets and calldata, while failing to clear or bind finalizeMessageHash to the current

来源：SlowMist_Team · x.com