ABAB News Logo
Back to Flash News

zkLink Confirms Ongoing Attack on Nova Arbitrator Contract and Offers a 20% White-Hat Bounty

zkLink officially posted on X that it has confirmed the attack targeting zkLink Nova’s Arbitrator contract on Ethereum and Optimism is still ongoing, and the technical team is taking emergency measures to contain the losses. The official account called on the attacker to stop further exploitation of the cross-chain contract and return the affected funds. If the funds are returned, a 20% white-hat bounty will be offered, and no further action will be pursued.

Earlier, SlowMist issued a security alert saying the related losses were about $783,100. The root cause was traced to the Arbitrator contract’s claimMessage function failing to clear the temporary finalizeMessageHash and failing to require a fresh authentication callback on every call. The attacker could inject a forged batch root through the publicly callable authorized SyncL2TxHashRelayer and withdraw assets.

The attack involves ETH and ERC-20 token withdrawals from the L1 escrow contract, and SlowMist listed the attacker address and the victim contract involved. The official said it will continue to update the community on developments.

Original sources:

  1. Title: We have identified an ongoing exploit targeting zkLink Nova’s Arbitrator contract on Ethereum and Optimism. Publisher: zkLink Official（@zkLink_Official） Publication date: 2026-10-29 URL: https://x.com/zkLink_Official/status/2115731883313254565 Source type: official statement Verification status: the full post was read in this session, accessed on 2026-10-29 Supporting content: confirmed the attack is still ongoing, the technical team is taking emergency measures, called for stopping the exploit and returning the funds, and offered a 20% white-hat bounty with no further pursuit

  2. Title: SlowMist TI Alert — @zkLink_Official Loss: ~783.1k Publisher: SlowMist（@SlowMist_Team） Publication date: 2026-10-29 URL: https://x.com/SlowMist_Team/status/2115635114638250409 Source type: security alert Verification status: the full post was read in this session, accessed on 2026-10-29 Supporting content: losses of about $783,100, claimMessage did not clear the temporary finalizeMessageHash, a new authentication callback was not required, and a forged batch root was injected through SyncL2TxHashRelayer to withdraw assets

  3. Title: zkLink Nova Bridge Exploited for ~$786K as Forged Batch Root Drains Ethereum Escrow Publisher: CryptoTimes Publication date: 2026-10-29 URL: https://www.cryptotimes.io/2026/10/29/zklink-nova-bridge-exploited-for-786k-as-forged-batch-root-drains-ethereum-escrow/ Source type: media report Verification status: relevant paragraphs were read in this session, accessed on 2026-10-29 Supporting content: the attack path is consistent with SlowMist’s analysis; does not prove the official bounty statement

ABAB AI Insight

zkLink positions itself as aggregated rollup infrastructure, and zkLink Nova is its Layer 3 zkEVM network. It synchronizes batch roots on Ethereum and other chains through cross-chain messages and escrow contracts to support asset withdrawals. The Arbitrator contract is responsible for verifying and forwarding cross-chain messages, and SyncL2TxHashRelayer is an authorized relayer that can be called publicly.

The attack path in this incident was: the attacker called SyncL2TxHashRelayer to populate a valid finalizeMessageHash, then in the same transaction replaced the target with EthereumGateway.sendMessage, triggered ZkLink.syncBatchRoot, injected self-selected l2LogsRootHashes, and submitted a matching forged withdrawal proof to withdraw assets from the L1 escrow contract. SlowMist pointed out that the root cause was that claimMessage did not clear the temporary hash and did not force reauthentication on each call.

A comparable reference is the situation in which some cross-chain bridges had assets withdrawn through forged proofs because of verification logic flaws. Similar to those cases, the attack exploited the combination of relayer privileges and uncleared temporary state; different from those cases, this incident involved Arbitrator contracts across multiple chains, and the official publicly offered a 20% white-hat bounty while the attack was still ongoing in exchange for the return of funds.

This incident changed the immediate risk status of zkLink Nova’s custodial assets: about $783,100 has been withdrawn, and the attack is still ongoing. The official chose to exchange a bounty for stopping the exploit. For cross-chain bridge users, custodial contracts that rely on automatic batch-root verification can have assets released all at once when there is a flaw in the verification logic. The monitoring indicators are whether the official later announces that the attack has been contained, whether some funds are returned, and whether the relevant contracts are repaired or paused.

ABAB News · Laws of cognition

  1. Uncleared temporary state in cross-chain message verification can allow a single valid authentication to be reused to forge a batch root.

  2. When a publicly callable authorized relayer is combined with a verification flaw, assets in a custodial contract can be withdrawn all at once.

  3. Offering a white-hat bounty while the attack is still ongoing prioritizes stopping the damage over post-incident recovery.