Approximately 515 million NIGHT tokens stolen, Wanchain Cardano cross-chain bridge attacked

Odaily Odaily Planet Daily News: Wanchain's Cardano cross-chain bridge was attacked, and approximately 515 million NIGHT tokens were stolen from the cross-chain bridge treasury. Preliminary investigation shows that the root cause lies in a non-injective signature message encoding issue in the TreasuryCheck validator. The signature message is constructed by naively concatenating 14 variable-length redemption fields without delimiters or length prefixes, allowing different combinations of field values to produce the same byte string, thus reusing the same hash and valid signature.