Nomad Bridge Hack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Nomad Bridge Website

Nomad Bridge was a popular bridging platform between different blockchains. The smart contract was audited by Quantstamp and held over $190m. An upgrade to the smart contract allowed for anyone to replace a valid withdrawal transaction with their own address, and the transaction would succeed. Over the course of hours the entire contract was quickly drained. Some white hat attackers returned a total of $36m of what had been taken, in exchange for a 10% bounty.

This is a global/international case not involving a specific country.

About Nomad Bridge

Homepage:

Audits:

"Nomad is a security-first cross-chain messaging protocol. By leveraging an optimistic mechanism, Nomad only requires one honest actor to keep the entire system safe."

"Secure Nomad allows off-chain watchers to challenge messages via fraud proofs, without relying on custodians or validators.

Gas-Efficient Nomad reduces gas fees by a factor of 10x relative to traditional header relay systems, while remaining decentralized.

Extensible Nomad smart contracts can be deployed quickly on any smart contract chain without requiring any custom logic."

"Nomad is a bridging protocol supporting Ethereum, Moonbeam, and other chains. Nomad’s bridging protocol is built using both on-chain and off-chain components. On-chain smart contracts are used to collect and distribute bridged funds while off-chain agents relay and verify messages between different blockchains. Each blockchain deploys a Replica contract which validates and stores messages in a Merkle tree structure. Messages can be validated by either providing proof with the proveAndProcess() call or for already verified messages they can be simply submitted with the process() call. Verified messages are forwarded to a Bridge handler (e.g. ERC20 Router) which can distribute bridged assets."

"Nomad enables applications to send data between blockchains (including rollups). Applications interact with Nomad core contracts to enqueue messages to be sent, after which off-chain agents verify and ferry these messages between chains. In order to ensure that message-passing is secure, Nomad uses an optimistic verification mechanism, inspired by fraud-proof based designs like optimistic rollups. This makes Nomad more secure, cheaper, and easier to deploy compared to validator / proof-of-stake based interoperability protocols."

"Nomad was audited by Quantstamp in June 2022."

"Because bridges offer a means of interoperability between multiple separate blockchain networks, they must hold large amounts of all tokens associated with each blockchain it bridges—thus creating a massive liquidity pool and an enticing target for hackers, whether that pool is managed by a centralized custodian or a smart-contract."

"According to Nomad’s post-mortem, an implementation bug in a June 21 smart contract upgrade caused the Replica contract to fail to authenticate messages properly. This issue meant that any message could be forged as long as it had not already been processed."

"Similar to the issue Theori had with Qubit, this is a path you don't expect just looking at it. "Why would they set 0 as a proof root?" is similar to "Why would they try to run address(0).transfer?""

"The first transactions started at Ethereum block 15259101 on August 1, 21:32:31 UTC. There were four relevant transactions within this same block, at indices 0, 1, 3, and 124. Each of these transactions drained 100 WBTC from the bridge."

"a routine upgrade marked the zero hash as a valid root, which had the effect of allowing messages to be spoofed on Nomad. Attackers abused this to copy/paste transactions and quickly drained the bridge in a frenzied free-for-all"

"It turns out that during a routine upgrade, the Nomad team initialized the trusted root to be 0x00. To be clear, using zero values as initialization values is a common practice. Unfortunately, in this case it had a tiny side effect of auto-proving every message"

"you didn't need to know about Solidity or Merkle Trees or anything like that. All you had to do was find a transaction that worked, find/replace the other person's address with yours, and then re-broadcast it"

"you just had to copy tx data and replace address lol"

"Nomad’s bridge got owned in a similar manner to Qubit’s QBridge. An insecure configuration of the bridge caused a specific path to allow any transaction sent. The error is inside the Replica’s “process” function."

"Nomad bridge getting rugged??? Looks very very sus"

"Not only was this hack one of the largest with over $190 million siphoned out of the Nomad liquidity pool, making it one of the more sizeable decentralized-finance (DeFi) hacks in history, but also one of the most chaotic as the technique used to steal funds required little technical knowledge, resulting in a fury of cash-grabbing copycats once news of the exploit spread on social media (Figure 1)."

"After a frenzied hack from hundreds of wallets, the bridge’s TVL dropped from $190,740,000 to $1,794 in mere hours. The hack involved a total of 960 transactions with 1,175 individual withdrawals from the bridge."

"The Security team at @a16z Crypto has investigated and found the root cause of the @nomadxyz_ bridge hack. Nothing to be done at this time except getting funds back from whitehats that drained preventively."

"Attention: White Hat Hacker Friends. Please return ETH or ERC-20 tokens to this wallet address: 0x94A84433101A10aEda762968f6995c574D1bF154"

"Nomad put forth a bounty following this hack—the bounty allowed attackers to keep 10 percent of their funds and face no legal action if the other 90 percent was returned. Oh, plus a Whitehat non-fungible token (NFT) as a thank you (Figure 2). Ultimately $36 million of the $190 million stolen was returned."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Nomad Bridge Hack

Date	Event	Description
August 1st, 2022 3:32:31 PM MDT	First Malicious Transaction	The first malicious transaction happens to drain funds from the bridge.
August 1st, 2022 3:37:00 PM MDT	Twitter Mention of Events	The suspicious withdrawal transactions are first posted to Twitter by user @spreekaway.
August 1st, 2022 3:46:00 PM MDT	Events Shared To Telegram	The tweet is reposted on Telegram, where it will shortly get the attention of samczsun.
August 1st, 2022 5:21:00 PM MDT	Fbslo Reports Accidental Exploit	Twitter user fbsloXBT reports accidentally exploiting the bridge and he "will return the funds asap". He clarified that it was really easy because "you just had to copy tx data and replace address lol".
August 1st, 2022 5:45:00 PM MDT	Samczsun Starts His Summary	Well-known blockchain researcher samczsun posts an analysis of the situation. He describes the losses as "over $150m" and the situation as "one of the most chaotic hacks that Web3 has ever seen".
August 1st, 2022 6:05:00 PM MDT	Matt Gleason Publishes Root Cause	A16z crypto researcher Matt Gleason publishes the root cause in a series of tweets, which are then spread through Twitter.
August 1st, 2022 6:17:00 PM MDT	Samczsun Publishes Root Cause	The cause is published as the routine upgrade completed by the Nomad team to initialize the "trusted root" to be 0x00.
August 1st, 2022 7:02:00 PM MDT	Coach K Crypto Warning	Coach K recommends everyone to "[d]on't use bridges" since "they aren't safe".
August 3rd, 2022 3:52:00 AM MDT	CoinDesk Article On Funds Returned	CoinDesk publishes an article reporting that the Nomad Bridge has received $9 million back from hackers a day after the protocol was exploited for $190.4 million. Blockchain security firm PeckShield said that the amount returned equates to around 4.75% of the total loss. Nomad Bridge is working with law enforcement and a leading chain analysis firm to trace funds, and Anchorage Digital will handle and safeguard the returned assets. The majority of the returned funds have been stablecoins, with $3.8 million USDC and $2 million USDT being sent back by multiple addresses. TBD history of article.
August 5th, 2022 11:34:16 AM MDT	Nomad Publishes Root Cause Analysis	Nomad publishes a post-mortem analysis of the incident, noting that it allowed attackers to mint counterfeit tokens on several Ethereum-based decentralized finance (DeFi) protocols. The security incident was caused by an implementation bug that allowed any message to be forged as long as it had not already been processed, resulting in fraudulent messages being passed to the Nomad BridgeRouter contract. This authentication failure resulted in fraudulent messages being passed to the Nomad BridgeRouter contract, allowing attackers to mint counterfeit tokens on several Ethereum-based decentralized finance protocols. Nomad BridgeRouter is a contract that is used to route messages to their destination chains. Nomad has stated that it has not identified any loss of funds or any other adverse consequences for its customers or users, and it has taken steps to prevent similar incidents from occurring in the future. The security incident occurred on June 22, 2022, and was disclosed to the public on June 25, 2022. TBD further analysis for other information to review.
August 15th, 2022	Halborn Analysis Published	Halborn publishes an article on their analysis of the hack. On August 1, the DeFi bridge Nomad was hacked for over $190m. Following the hack, the bridge's total value locked (TVL) dropped from $190,740,000 to $1,794 in mere hours. Nomad is a cross-chain bridge used for swapping tokens between Ethereum, Avalanche, Evmos, Milkomeda C1, and Moonbeam. Nomad confirmed on Twitter that the vulnerability was not exploited on any chain except for Ethereum, and only Ethereum-based assets were involved in the hack. The hack was caused by an implementation bug in a June 21 smart contract upgrade that caused the Replica contract to fail to authenticate messages properly, leading to fraudulent messages being passed to the Nomad BridgeRouter contract. As of August 15, over $33m has been returned to Nomad's wallet by whitehat hackers. The article was ghost written by Jason Levin.
September 17th, 2022 11:22:05 AM MDT	CoinBase Publishes Analysis	CoinBase publishes a highly detailed analysis of the exploit. They report the attack resulted in the loss of more than $186m in a few hours. Nomad Bridge was built using on-chain and off-chain components, with smart contracts being used to collect and distribute bridged funds. On April 21, 2022, Nomad deployed a Replica proxy contract to handle processing and validation of users’ claims of bridged assets. It set initial contract parameters and defined an entry for a trusted value. However, during the initialization process, the trusted value was set to 0, resulting in an issue when fraudulent messages are sent directly to the process() method, allowing authorization of fraudulent messages. Attackers used this vulnerability to send a specially crafted payload, stealing 100 Wrapped BTC (WBTC) from Nomad Bridge. Coinbase has published a blog post about the Nomad Bridge incident analysis to share lessons about the vulnerability, exploitation methodology, and on-chain analysis of attacker behaviour. TBD further details are in this blog post.
November 29th, 2022 12:47:57 PM MST	Mandiant Publishes Analysis	Mandiant, a cybersecurity firm, published a blog post about the Nomad bridge smart-contract exploit, in which it analyses the on-chain transactions post-compromise. The firm uses the blockchain investigative software, CryptoVoyant, developed by Cyber Team Six, to uncover the way the hack was conducted. In August 2022, a bridge attack was performed on the Nomad token bridge, resulting in the theft of over $190m from the Nomad liquidity pool. This was one of the largest decentralised finance (DeFi) hacks in history and required little technical knowledge to perform. This lack of expertise led to numerous copycat attacks, resulting in a greater financial loss. Bridges, whether custodial or non-custodial, offer a means of interoperability between multiple separate blockchain networks, and hold large amounts of all tokens associated with each blockchain it bridges, making them an enticing target for hackers. TBD - More details could be gathered from this post to add to other sections.

Technical Analysis

The situation has been technically analyzed by multiple community experts.

Matt Gleason's Analysis

Researcher for A16Z Matt Gleason published a summary of the the technical issue.

1/ Nomad’s bridge got owned in a similar manner to Qubit’s QBridge. An insecure configuration of the bridge caused a specific path to allow any transaction sent. The error is inside the Replica’s “process” function.

2/ Process is designed to ensure that a message has been proven, then processes the message, which should normally be fine.

3/ It does this using acceptableRoot, which will check that the root has either been proven or the it was confirmed before the current time.

4/ The problem occurs because in solidity if a map key hasn’t been seen before it will default to zero, resulting in attempting to confirm a root of zero. However, because they initialized with the confirmedRoot of 0, that means zero is technically a confirmed root.

5/ As a result, the system will accept any message that it has never seen before and process it as if it were genuine, meaning that all you need to do is ask for all the bridge’s money and you’ll get it.

Samczsun's Analysis

Blockchain researcher samczsun was one of the first to start providing a full explanation of the events which unfolded and get to the root cause of the issue. His series of Tweets outlined his analysis in real-time as he composed it:

1/ Nomad just got drained for over $150M in one of the most chaotic hacks that Web3 has ever seen. How exactly did this happen, and what was the root cause? Allow [him] to take you behind the scenes

2/ It all started [for him] when @officer_cia shared @spreekaway's tweet in the ETHSecurity Telegram channel. Although [he] had no idea what was going on at the time, just the sheer volume of assets leaving the bridge was clearly a bad sign

3/ [His] first thought was that there was some misconfiguration for the token's decimals. After all, it seemed as though the bridge was running a "send 0.01 WBTC, get 100 WBTC back" promotion

4/ However, after some painful manual digging on the Moonbeam network, [he] confirmed that while the Moonbeam transaction did bridge out 0.01 WBTC, somehow the Ethereum transaction bridged in 100 WBTC

5/ Furthermore, the transaction to bridge in the WBTC didn't actually prove anything. It simply called `process` directly. Suffice to say, being able to process a message without proving it first is extremely Not Good

6/ At this point, there were two possibilities. Either the proof had been submitted separately in an earlier block, or there was something extremely wrong with the Replica contract. However, there was absolutely no indication that anything had been proven recently

7/ This left only one possibility - there was a fatal flaw within the Replica contract. But how? A quick look suggests that the message submitted must belong to an acceptable root. Otherwise, the check on line 185 would fail

8/ Fortunately, there's an easy way to sanity check this assumption. [He] knew that the root of a message which had not been proven would be 0x00, because messages[_messageHash] would be uninitialized. All [he] had to do was check whether the contract would accept that as a root

9/ Oops

10/ It turns out that during a routine upgrade, the Nomad team initialized the trusted root to be 0x00. To be clear, using zero values as initialization values is a common practice. Unfortunately, in this case it had a tiny side effect of auto-proving every message

11/ This is why the hack was so chaotic - you didn't need to know about Solidity or Merkle Trees or anything like that. All you had to do was find a transaction that worked, find/replace the other person's address with yours, and then re-broadcast it

12/ tl;dr a routine upgrade marked the zero hash as a valid root, which had the effect of allowing messages to be spoofed on Nomad. Attackers abused this to copy/paste transactions and quickly drained the bridge in a frenzied free-for-all

Total Amount Lost

The total amount lost has been estimated at $190,740,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

Because the exploit required a very limited amount of technical knowledge to exploit, it was exploited widely, including by accident. Multiple analysis were published about the events in real-time, while the attack was going on, which only acted to accelerate the rate of asset depletion from the bridge.

Technical Analyses Shared

Both Matt Gleason and Samczsun shared a technical analysis of the events through Twitter.

Community Reactions on Twitter

Coach K

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

A bounty of $3,600,000 USD was paid for the discovery.

Total Amount Recovered

The total amount recovered has been estimated at $36,000,000 USD.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

All of the funds were placed in a hot wallet, when this could have been better secured by a multi-signature setup. Further reviews/audits of the smart contract could have been performed. Only one firm was used.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.