SlowMist 披露 zkLink 遭攻击损失约 78.31 万美元

🚨SlowMist TI Alert🚨 💸 @zkLink_Official Loss: ~783.1k 🔍 Root Cause: Arbitrator.claimMessage failed to clear the transient finalizeMessageHash and require a fresh authenticated callback for each invocation. Through the publicly callable, authorized SyncL2TxHashRelayer, the attacker first populated a valid hash, then reused it while substituting EthereumGateway.sendMessage as the claim target. This executed ZkLink.syncBatchRoot under the legitimate gateway identity, installed an attacker-chosen l2LogsRootHashes root, and withdrew assets using forged proofs. 📌 Attacker: 0xaca0655a11200a80d33d0e48786317304cde5718, 0xDAB137F390dF77caA97fd492540E973fd5e2F8c8 📌 Victims: ZkLink 0x5fd9f73286b7e8683bab45019c94553b93e015cf; L1ERC20Bridge 0xad16edcf7deb7e90096a259c81269d811544b6b6 📌 Vulnerable Contract: Arbitrator 0x1ee09a2caa0813a5183f90f5a6d0e4871f4c6002 (implementation: 0x7a0bb4805ecb7fd3c8dabbe4afa0e91cb1761e34) Powered by http://SlowMist.AI Tx: https://etherscan.io/tx/0x4f3c23e75b9134e8

来源：SlowMist_Team · x.com