A bug in NEAR Intents' deposit notification feature let an attacker exploit failed third-party contract calls, minting $3.8M in ghost funds across 23 transactions before withdrawing via Omni. The flaw arose because the token contract refunded deposits while NEAR Intents kept records, letting the attacker legitimately bridge funds out between Sept 29 and Oct 1. All funds were recovered within 36 hours after negotiations with the attacker. The team removed the notification feature, added automatic invariant monitoring that pauses the contract, and awarded $300k for a related bug bounty report.

AI summary of the linked source — not editorial content.

Explore the topic

Loading related coverage…

Explore the full feed

Comments

Loading comments…