ZetaChain: GatewayEVM attack resulted in approximately $333.9k in losses, user funds unaffected

robot
Abstract generation in progress

Layer 1 Network ZetaChain states that on April 24th, an attack targeted its cross-chain message pipeline vulnerability. The attacker exploited three issues within the cross-chain messaging system, stealing $333,868 from three internal team wallets, mainly in USDC and USDT, involving nine transactions across Ethereum, Arbitrum, Base, and BSC chains, with no user funds lost. ZetaChain claims that the attacker used vulnerabilities such as insufficient arbitrary call restrictions, the GatewayEVM contract accepting most commands including transferFrom, and users granting unlimited permissions through previous deposits via GatewayEVM.deposit() that were not revoked. The attack was not opportunistic; the attacker invested significant time and resources in preparation before executing. ZetaChain states that patches have been deployed on the mainnet, cross-chain transaction functions remain paused, and will be re-enabled after upgrades and additional audits. Users who interacted with the ZetaChain gateway contract are advised to revoke related ERC-20 permissions. (The Block)

ETH-0.15%
ARB0.25%
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments