Taiko ERC20 Vault attacked, losses exceed $1 million

BlockBeats news. On June 22, security company Blockaid said that it detected an attack on Taiko’s ERC20 Vault on Ethereum, with losses exceeding $1 million.

Initial analysis shows that the vulnerability stems from a flaw in Taiko’s cross-chain bridge source-signal proof verification mechanism. The message proofs constructed by the attackers were still accepted by the Ethereum mainnet even without corresponding legitimate MessageSent events on the Taiko chain, enabling them to register and extract forged cross-chain messages, ultimately resulting in unauthorized release of assets from the ERC20 Vault.