NEAR Intents Discloses $3.8 Million Vulnerability Incident: Attacker Exploited Deposit Notification Flaw to Generate Fake Balances, Funds Fully Returned

Odaily News — Cross-chain swap protocol NEAR Intents has released a post-mortem report on a vulnerability incident, disclosing that a prior incident involving the extraction of $3.8 million in assets stemmed from a flaw in the deposit notification function. The attacker created a smart contract designed to deliberately cause notification failures, allowing deposited tokens to be returned while the protocol's internal ledger still recorded the corresponding balances.

The report shows that the attacker accumulated $3.8 million in fake balances with no actual asset backing through 23 failed deposit transactions, and withdrew real tokens between September 29 and October 1, transferring them to other blockchains via Omni infrastructure. NEAR Intents General Manager Alex Shevchenko emphasized that the vulnerability existed in the NEAR Intents contract, not in the Omni infrastructure.

NEAR Intents stated that the attacker returned all funds within 36 hours after the vulnerability was discovered, and all affected users have been fully compensated. The team has improved its balance monitoring mechanisms and completely removed the vulnerable function on October 7. Additionally, another security researcher who discovered a related critical vulnerability received a $300,000 reward.