ChainCatcher report: The cross-chain exchange protocol NEAR Intents has released a post-incident report attributing a $3.8 million vulnerability to a flaw in its deposit notification function. The protocol, deployed on NEAR, uses a public settlement contract to maintain an internal ledger of deposited tokens, with withdrawals executed via a cross-chain bridge to transfer tokens out. The report, published by NEAR Intents CEO Alex Shevchenko on October 16, states that the attacker withdrew $3.8 million prior to the protocol’s shutdown on October 1 and returned all funds within 36 hours of detection; all affected users have been fully compensated. The report explains that the vulnerable function notified a third-party contract upon token deposit. The attacker created a contract deliberately designed to fail the notification, causing the token contract to refund the deposit while NEAR Intents retained the corresponding ledger credit. Across 23 failed deposit transactions, the attacker accumulated $3.8 million in unsupported balances—termed “ghost funds”—and subsequently withdrew real tokens, transferring them to other chains via the Omni infrastructure. Shevchenko emphasized that this was a vulnerability in the NEAR Intents contract, not in the Omni infrastructure. Withdrawals occurred between September 29 and October 1. The settlement contract was paused and later reopened on October 1; affected routes were gradually restored, and deposit functionality on the contract side resumed on October 2. The vulnerability went undetected because monitoring only compared the total token balance on the original chain with the total balance on the NEAR side, without verifying the sum of user internal balances against the actual tokens held by the contract. The team has since implemented this additional check and now automatically pauses the contract if discrepancies are detected. The October vulnerability was patched on October 2; however, a separate critical vulnerability report concerning the same function led to its complete removal on October 7, for which the researcher received a $300,000 bounty.
NEAR Intents Releases Post-Mortem Report on $3.8M Vulnerability
ChaincatcherShare
Summary
On-chain news: NEAR Intents published a post-mortem report on a $3.8 million exploit caused by a deposit notification flaw. The vulnerability enabled an attacker to accumulate unbacked balances between September 29 and October 1. The settlement contract was paused on October 1 and reopened on October 2. CEO Alex Shevchenko confirmed the flaw was in their contract, not Omni. A second vulnerability in the same function was patched on October 7, with a $300,000 reward paid to the researcher. Vulnerability news: The incident underscores ongoing risks in cross-chain infrastructure.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.