A zero where a root should have been
Nomad verified incoming messages by checking them against a trusted root. A routine upgrade set that root to zero. Because of how the verification logic treated the zero value, every message — including entirely fabricated ones — evaluated as already proven.
The result was that withdrawing from the bridge required no exploit development at all. An observer could copy a successful transaction, replace the recipient address with their own, and submit it. That is why several hundred distinct addresses participated within hours. It was, in the most literal sense, a queue.
Why it matters more than the figure
Most large exploits require genuine skill and are therefore rate-limited by the number of people capable of executing them. This one was not. Once the pattern was visible on-chain, the population of potential participants was everyone watching. Any defect that removes the skill requirement should be treated as categorically more urgent than one of equivalent nominal value that does not.
Upgrades are the risk surface
The defect was introduced by a routine upgrade, not by the original design. Upgradeable contracts move the security question from “was this audited” to “what happened at every subsequent deployment, and was the resulting state verified”. Initialisation values are exactly the sort of thing that passes review as boilerplate.
Timeline
Append-only. Corrections are added as their own dated entry; earlier entries are never rewritten.
- The first exploit transaction executes. Within hours hundreds of addresses replicate it by copying the calldata and substituting their own address. Nomad
- Nomad publicly confirms the incident and asks for the return of funds. Nomad
What to check
Nomad published a root-cause analysis, linked below, describing the initialisation error and the upgrade that introduced it.
Conisec does not host or link recovery, revocation or "checker" tools. After a public incident, attackers routinely seed exactly those links using the names of publications covering the story. Use the affected project's own official channel, linked above, and nothing else.
Sources
- Nomad, Nomad Bridge Hack Root Cause Analysis (1 Aug 2022)
Not advice. This is a summary of published facts, not legal, tax or security advice. Verify against the primary sources linked above.
Last verified by Conisec Staff.
