-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0294
============================================================

Advisory-ID:  0xCERT-2026-0294
Severity:     Medium
Published:    2026-10-28T22:21:35.000Z
Updated:      2026-11-01T00:44:02.340Z
Chains:       Ethereum, Optimism, Base, Other / Multi-chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0294

Title: zkLink Nova bridge escrows drained of about $743k-$783k via forged batch root in Arbitrator relay path

Summary
- -------
An attacker forged a zkLink Nova batch root on Ethereum through a public relayer and the Arbitrator's claimMessage flaw, draining both Ethereum escrows (about $743k-$783k); a second actor repeated it on Optimism, Base, Blast and Mantle. Withdrawals were disabled and contracts patched.

Details
- -------
Summary
At 22:21:35 UTC on 2026-10-28 (Ethereum block 26294188) a single transaction emptied zkLink Nova's Ethereum escrows (ZkLink ETH escrow and L1ERC20Bridge): 22.43 ETH plus 11 ERC-20 tokens, led by about 245.74 pufETH. The attacker wrote their own Merkle root for batch 116409 into the bridge and withdrew against proofs they built themselves. No key or signature was compromised. About nine hours later a second, unrelated actor reused the still-unpatched flaw against zkLink Nova escrows on Optimism, Base, Blast and Mantle.

Affected
- - zkLink Nova Arbitrator (Ethereum) claimMessage(), reached through the public SyncL2TxHashRelayer, and the escrows that trust its batch roots on Ethereum and secondary chains
- - zkLink said it suspended Nova block production, emergency-patched the affected contracts and temporarily disabled withdrawals

Impact
Per Parapet Labs, Arbitrator.claimMessage() made a relayer-chosen external call under the Arbitrator's trusted identity and checked an EIP-1153 transient hash (finalizeMessageHash) that was never cleared, so one genuine Linea message claim in a transaction let a later claim forge a syncBatchRoot call. Loss estimates on Ethereum: about $743k (Parapet Labs, exploit-time prices), about $780k (BlockSec Phalcon), about $783.1k (SlowMist). Second wave (2026-10-29 ~07:16 UTC): about 24.76 ETH plus token inventories from Optimism, Base, Blast and Mantle escrows, which Parapet Labs attributes to a different actor. Exploitation in the wild is confirmed.

Recommended actions
- - Do not deposit into or bridge through zkLink Nova until the team confirms the fix and resumes withdrawals through official channels
- - Integrators and exchanges: flag the attacker addresses below and monitor fund movements
- - Bridge builders: clear transient-storage authentication flags after use and never make caller-chosen external calls from a privileged identity

Source & attribution
This 0xCERT advisory summarises the Parapet Labs post-mortem: https://parapetlabs.net/blog/zklink-nova-exploit-post-mortem/, with alerts by BlockSec Phalcon (https://x.com/Phalcon_xyz/status/2115671779717083260) and SlowMist (https://x.com/SlowMist_Team/status/2115635114638250409), zkLink's statement (https://x.com/zkLink_Official/status/2115792847098216545), and an analysis by Panda Security. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://parapetlabs.net/blog/zklink-nova-exploit-post-mortem/
- - https://x.com/Phalcon_xyz/status/2115671779717083260
- - https://x.com/SlowMist_Team/status/2115635114638250409
- - https://x.com/zkLink_Official/status/2115731883313254565
- - https://x.com/zkLink_Official/status/2115792847098216545
- - https://dev.to/pandasecurity/zklink-nova-exploit-a-stale-transient-hash-forged-a-root-oji
- - https://etherscan.io/tx/0x4f3c23e75b9134e8cae5a462550daad42fbbc19242567fcc34c0a035e297462c

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmroIvIJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmf2SqGXoG615nZOzYDgQyfGtLA9KWd9OOmGxrnK
3Vsr7RYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAvigD7BwR4bLpoZWLxpGuv
UYDyY0cRqy4pE7NyokllPS7cFugA/ivAcqUxeANO6L4ZyuLA8YrEOu73sbIN
En295ih10+AD
=eXkA
-----END PGP SIGNATURE-----