SlowMist: zkLink Suffers Attack With Approximately $783,000 in Losses, Involving Transient Storage Vulnerability

TechFlow report, October 31: According to analysis by the SlowMist security team, cross-chain protocol zkLink was attacked on October 29, with losses of approximately $783,000. The attacker exploited residual verification values in transient storage to forge the batch root used for withdrawal verification, then completed 12 withdrawals, including 1 ETH withdrawal and 11 ERC-20 token withdrawals.

The analysis noted that the attacker first obtained and wrote a verification value through a genuine cross-chain message, then reused that value in subsequent calls within the same transaction, leveraging relay and gateway contracts to write forged batch roots. The relevant contracts allow relayers to specify external call targets and parameters; verification values were not cleared or bound to the current call, and batch root updates only checked gateway identity, lacking independent proof verification.

Source: TechFlow