NEAR Intents Vulnerability Report: $3.8 Million Loss Due to Deposit Notification Flaw

The cross-chain exchange protocol NEAR Intents has released a report attributing a $3.8 million vulnerability to a defect in its deposit notification feature. The protocol maintains an internal ledger of deposited tokens through its public settlement contract on NEAR, with withdrawals executed via a cross-chain bridge. The report, published by General Manager Alex Shevchenko on October 16, states that attackers withdrew $3.8 million before the protocol was shut down on October 1, and returned all funds within 36 hours of detection, with all affected users fully compensated. The report indicates that the feature notifies third-party contracts when tokens are deposited, and the attackers created contracts that intentionally caused the notifications to fail, allowing the token contract to refund the deposits while NEAR Intents retained the corresponding ledger credit. Through 23 failed deposit transactions, the attackers accumulated a $3.8 million unsupported balance, referred to in the report as "ghost funds," and subsequently withdrew real tokens, transferring them to other chains via the Omni infrastructure. Withdrawals occurred between September 29 and October 1, with the settlement contract paused on October 1 and reopened later, while contract-side deposits resumed on October 2. The report states that the vulnerability went undetected because monitoring only compared the original chain assets with the total balance of NEAR-side tokens, without comparing the total internal user balances with the actual tokens held by the contract; the team has since added this check and will automatically pause the contract when discrepancies are detected. The fix for the vulnerability was deployed on October 2, but another serious vulnerability report regarding the same feature prompted its complete removal on October 7, with the relevant researcher receiving a $300,000 reward.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.