zkLink Nova confirms cross-chain bridge attack, offers 20% white hat bounty

October 29 - zkLink announced that an attack targeting the Arbitrator contracts of zkLink Nova on Ethereum and Optimism has been confirmed and is still ongoing. The technical team is urgently addressing the situation to contain losses. The official team has called on the attackers to cease further exploitation of the omnichain contracts and return the affected funds. If the funds are returned, a 20% white-hat bounty will be offered, and no further action will be pursued.

Previously, SlowMist issued a security alert stating that the related losses amounted to approximately $783,100. The root cause points to the Arbitrator contract's claimMessage not clearing the temporary finalizeMessageHash and not requiring each call to go through a new authentication callback. Attackers could exploit the publicly callable authorized SyncL2TxHashRelayer to inject a forged batch root and withdraw assets.