Nomad Bridge exploit

Exploits

Nomad BridgeAug 1, 2022

$190M lost#19 on rekt.newsPartly returned

Overview

Lost

$190M

#19 on the rekt.news leaderboard

Came back

$33M

Partly returned

Attacked

Replica.process

Unsafe initialization

Audit

Quantstamp

Ethereum

What happened

A June upgrade initialized Nomad's Replica with the zero hash as its committed root and marked it confirmed. A message that was never proven reads as root 0x00, so process() accepted any message: the first caller withdrew from the bridge, and hundreds of addresses copied the transaction with their own address in it.

bridgeupgradedefault valuemessage verification

Timeline

Jun 2022An upgrade initializes the Replica with the zero root, confirmed.
Aug 1, 2022First unproven message processed; copycats follow. About $190M leaves in under three hours.
Aug 2022Nomad offers a 10% bounty; whitehats return about $33M.

Attack flow

A zero root that proved everythingmissing check

Caller

Nomad

Replica

BridgeRouter

What happens

1
initialize()
Replica.initialize
June 2022 upgrade: the Replica is initialized with committedRoot = 0x00 and confirmAt[0x00] = 1, so the zero root counts as confirmed from the start.
Missing check. The initializer accepted the zero hash as a root and confirmed it.
2
edits a message
Caller edits a message
August 1: a caller takes a real bridge message, puts its own address in it, and never proves it.
3
process()
Replica.process
process() looks up messages[hash] for the root the message was proven against. Unproven, the entry holds the default value, 0x00.
4
acceptableRoot()
Replica.acceptableRoot
acceptableRoot(0x00) reads confirmAt[0x00] = 1, a time in the past: accepted.
Missing check. acceptableRoot should never accept the zero root, the value of every unproven message.
5
handle()
BridgeRouter.handle
The router trusts the Replica and releases the tokens the message names to the caller.
6
copies
Caller copies
Others copy the transaction, changing only the address: about $190M left the bridge in under three hours.

Funds

Balance changes and fund flow, from the sources

PartyAssetValueNet

Nomad bridgeLostBridged tokens−$190M−$190M

Callers (hundreds of addresses)GainedThe three largest took about $47M, $40M and $8M.Bridged tokens+$190M+$190M

Returned by whitehatsGot backAbout $156M was not recovered.Mostly USDC and USDT+$33M+$33M

Fund flow, in order

[1] $190M[2] $33M returned

Nomad bridge−$190M

Callers (hundreds of addresses)+$190M

Returned by whitehats+$33M

Root cause

Replica.sol (Nomad) · illustrative, written to the pattern

11function initialize(bytes32 _committedRoot /* , ... */) public initializer {

2− committedRoot = _committedRoot; // 0x00 in the June upgrade

3− confirmAt[_committedRoot] = 1; // so the zero root is "confirmed"

2+ require(_committedRoot != bytes32(0), "!root");

3+ committedRoot = _committedRoot;

4+ confirmAt[_committedRoot] = 1;

Missing check. The initializer accepted the zero hash as a root and confirmed it.

45}

67function acceptableRoot(bytes32 _root) public view returns (bool) {

8+ if (_root == bytes32(0)) return false; // the value of every unproven message

Missing check. acceptableRoot should never accept the zero root, the value of every unproven message.

79 uint256 _time = confirmAt[_root];

810 if (_time == 0) return false;

911 return block.timestamp >= _time;

1012}

Why it broke

An unset mapping entry reads as zero. The initializer made zero a trusted root, so the absence of a proof became a proof.

Catch it

Tests of intended behaviour, never attack code

The invariant that would have failed

process() succeeds only for a message proven against a confirmed, non-zero root.

As a Foundry test· illustrative, write it against your own contracts

function test_process_rejectsAnUnprovenMessage() public {    bytes memory message = _message(recipient, amount); // never passed to prove()    vm.expectRevert("!proven");    replica.process(message);}

What an auditor checks0/3

For every check that reads a mapping, ask what the default value (0x00) means. A zero key must never be a valid root, owner or signer.
Review the arguments an upgrade is initialized with, not only its code: the bug here was a configuration value.
Follow audit findings marked acknowledged or misunderstood to a fix or a test; Quantstamp's QSP-19 pointed close to this.

In Luora. Write the invariant as a Foundry test of intended behaviour: processing a message that was never proven must revert. Atlas shows which functions read messages and confirmAt; the test covers their default case.

Sources