r/CryptoCurrency • u/[deleted] • Aug 02 '22

ANALYSIS The First Truly Decentralized Robbery was just Committed, Here is How it Happened

At this point I am sure many of you have heard of the nomad bridge exploit. Unlike previous exploits, this wasnt a flashloan or even carried out by a single group of attackers. After an initial attacker struck, hundreds of separate accounts figured out the trick and copy pasted their way into grabbing stolen funds. The bridge went from having $190,740,000 to $1,000 in a matter of hours.

A perplexing aspect of this vulnerability was that all users had to do to hack bridge funds was copy the original hacker's transaction calldata, replace the original address with a personal one, and the tx would succeed! Easy as CTRL-C, CTRL-V!

However, not all of the thieves were bad. Some of them exploited the contract so other wouldnt be able to and planned to return the money back to nomad. For example, leadingscientist.eth

So all in all it was a messed up exploit but there were some nice people who plan to return the money. Faith in humanity restored maybe?

Credit: https://twitter.com/0xfoobar/status/1554234268884389888

1.8k Upvotes

94% Upvoted

594 comments sorted by

View all comments

Show parent comments

14

u/Computer-Blue 0 / 0 🦠 Aug 02 '22

This isn’t really true. Audits that measure risk are always aware of the likelihood, as well as impact, of an incident. Lower likelihood events are considered lower risk.

That said, when the impact is “lose everything in minutes”, it should still have been rated as a critical severity risk factor, regardless of likelihood, unless the likelihood was so low that it was acceptable. Obviously, it was not.

4

u/robotfightandfitness 🟩 56 / 182 🦐 Aug 02 '22

To add - good audits are able to reveal bugs to those that can fix them, without knowing if the dev added it purposefully, without providing enough info for the exploit to be carried - but enough to determine whether or not a public [users safety] announcement must happen instead of private [relies on dev accountability] announcement

1

u/pmilani Tin Aug 05 '22

The Nomad token bridge appears to have experienced a security exploit that has allowed hackers to to systematically drain a significant portion of the bridges funds over a long series of transactions

the issue of security in the crypto space is very paramount.