News linked to both this project and an event.
zkLink has announced a bounty program in response to the recent security incident affecting zkLink Nova, aimed at facilitating the recovery of affected funds. Security researchers or white-hat contributors who provide information that materially assists in fund recovery may receive a reward of up to 20% of the recovered amount, with specific eligibility and reward amounts to be determined by zkLink based on the value of the information provided.Additionally, if the exploiter returns all funds, they may retain 20% as a white-hat bounty, and zkLink commits not to take further legal action regarding the returned funds. Related communications can be conducted through zkLink's official X account or email.
Odaily reports: According to zkLink monitoring, the attack on the Arbitrator contracts of zkLink Nova on Ethereum and Optimism is still ongoing, and the technical team is urgently responding to contain the losses. zkLink has called on the attackers to stop further exploiting the omnichain contracts and return the affected funds, stating that if the attackers cooperate in returning the funds, a 20% white-hat bounty will be offered and no further action will be pursued. Previously, SlowMist issued a security alert stating that the related losses amounted to approximately $783,100. The root cause of the attack points to the Arbitrator contract's claimMessage failing to clear the temporary finalizeMessageHash and failing to require each call to go through a new authentication callback; attackers can exploit the publicly callable authorized SyncL2TxHashRelayer to inject a forged batch root and withdraw assets.
Blockaid has published two attacker addresses, example attack transactions, victim contracts, and cross-chain bridge addresses. One of the attacker addresses (0xaCA0...5718) currently holds a balance of approximately $11,000 USD.