Loss of approximately $783,000: zkLink attacked in transient storage vulnerability incident

Odaily — According to an analysis by the SlowMist security team, the cross-chain protocol zkLink was attacked on October 29, resulting in a loss of approximately $783,000. The attacker exploited residual verification values in transient storage to forge the batch root required for withdrawal verification, and then completed 12 withdrawals, including 1 ETH withdrawal and 11 ERC-20 token withdrawals. The attacker first claimed and wrote a verification value through a genuine cross-chain message, then reused that value in a subsequent call within the same transaction, using the relayer and gateway contracts to write a forged batch root. The relevant contracts allow relayers to specify external call targets and parameters, and the verification value was neither cleared nor bound to the current call; batch root updates only verify the gateway identity and lack independent proof verification.