News linked to both this project and an event.
zkLink has announced a bounty program in response to the recent security incident affecting zkLink Nova, aimed at facilitating the recovery of affected funds. Security researchers or white-hat contributors who provide information that materially assists in fund recovery may receive a reward of up to 20% of the recovered amount, with specific eligibility and reward amounts to be determined by zkLink based on the value of the information provided.Additionally, if the exploiter returns all funds, they may retain 20% as a white-hat bounty, and zkLink commits not to take further legal action regarding the returned funds. Related communications can be conducted through zkLink's official X account or email.
Odaily reports: According to zkLink monitoring, the attack on the Arbitrator contracts of zkLink Nova on Ethereum and Optimism is still ongoing, and the technical team is urgently responding to contain the losses. zkLink has called on the attackers to stop further exploiting the omnichain contracts and return the affected funds, stating that if the attackers cooperate in returning the funds, a 20% white-hat bounty will be offered and no further action will be pursued. Previously, SlowMist issued a security alert stating that the related losses amounted to approximately $783,100. The root cause of the attack points to the Arbitrator contract's claimMessage failing to clear the temporary finalizeMessageHash and failing to require each call to go through a new authentication callback; attackers can exploit the publicly callable authorized SyncL2TxHashRelayer to inject a forged batch root and withdraw assets.
According to the Arbitrum Security Council report, Arbitrum took emergency action at around 23:30 Beijing Time on October 2 to temporarily halt the activation of new Stylus contracts on Arbitrum One and Nova, in order to mitigate the risk of AI-assisted attacks utilizing custom WebAssembly programs.