NEAR Intents Discloses Exploit Update: Attacker Exploited Deposit Notification Flaw to Generate Fake Balances, Funds Fully Returned

BlockBeats news, October 17: Cross-chain swap protocol NEAR Intents has released a post-mortem report on a vulnerability incident, disclosing that a previous incident involving the withdrawal of $3.8 million in assets stemmed from a flaw in the deposit notification function. The attacker created a smart contract deliberately designed to cause notification failures, allowing deposited tokens to be returned while the protocol's internal ledger still recorded the corresponding balance.

The report shows that the attacker accumulated $3.8 million in false balances without actual asset backing through 23 failed deposit transactions, and between September 29 and October 1 withdrew real tokens, transferring them to other blockchains via Omni infrastructure. NEAR Intents General Manager Alex Shevchenko emphasized that the vulnerability existed in the NEAR Intents contract, not in the Omni infrastructure.

NEAR Intents stated that the attacker returned all funds within 36 hours after the vulnerability was discovered, and all affected users have been fully compensated. The team has improved its balance monitoring mechanism and completely removed the vulnerable functionality on October 7. In addition, another security researcher who discovered a related critical vulnerability received a $300,000 reward.