Cross-chain liquidity protocol CrossCurve (formerly EYWA) confirms that its cross-chain bridge was attacked due to a smart contract vulnerability. The attack stemmed from missing gateway verification, allowing the attacker to forge cross-chain messages and bypass validation, triggering unauthorized token unlocks in the PortalV2 contract, resulting in approximately $3 million worth of funds being transferred out across multiple chains; security analysis shows that the vulnerability is located in the ReceiverAxelar contract, whose expressExecute function can be called directly to inject forged messages and carry out the attack. (The Block)

EYWA-1.19%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.