ZetaChain vulnerability was reported in advance by white hats but ignored, ultimately leading to a $334k attack incident.

BlockBeats News, April 29 — Cross-chain protocol ZetaChain disclosed that its recent security incident involving approximately $334k in a vulnerability attack was reported in advance by researchers through the bug bounty program, but at the time was considered “expected behavior” by the project team and was not addressed. According to the official incident review, the attack originated from a combination of three seemingly independent and low-risk design flaws:

The Gateway contract allows anyone to send arbitrary cross-chain instructions;
The receiving end can almost execute calls on any contract, with overly narrow blacklist restrictions;
Some wallets have long retained unlimited approvals that have not been cleaned up.

The attacker ultimately combined these flaws to instruct the Gateway to transfer tokens directly to their control address, thereby completing the asset transfer. ZetaChain stated that the attack involved nine transactions across four chains: Ethereum, Arbitrum, Base, and BSC. The stolen funds all came from wallets controlled by ZetaChain, and user funds were not affected.

The official said the attack was clearly premeditated. The attacker funded the wallet via Tornado Cash three days before the attack, deployed a dedicated Drainer contract in advance, and also carried out an address poisoning attack.

Currently, ZetaChain has begun pushing patches to the mainnet nodes, permanently disabling the arbitrary call function, and has changed the unlimited approval mechanism in the deposit process to “precise approval.”