A deposit-notification bug let an attacker withdraw $3.8 million from NEAR Intents before its Oct. 1 shutdown, according to a newly published postmortem. The protocol says the attacker returned the funds and that it has removed the feature after another critical vulnerability report.
NEAR Intents says a deposit-notification bug let an attacker withdraw $3.8 million before the protocol shut down on Oct. 1. The postmortem, published Oct. 16 by general manager Alex Shevchenko, says the attacker returned the full amount within 36 hours of detection. All affected users were made whole, it says.
NEAR Intents enables cross-chain swaps. Its public settlement contract on NEAR keeps an internal ledger of deposited tokens, and withdrawals move tokens out through bridges.
Refunded deposits still counted as funds
According to Shevchenko, the vulnerable feature notified third-party contracts when tokens were deposited. The attacker built a contract that deliberately failed those notifications, so the token contract refunded the deposit while NEAR Intents kept the corresponding ledger credit.
Across 23 failed deposit transactions, the attacker accumulated $3.8 million in unbacked balances, which the postmortem calls "ghost funds." The attacker then withdrew real tokens against those balances and moved them to other chains through Omni infrastructure, the report says. Shevchenko wrote that the flaw sat in the NEAR Intents contract, not in the Omni infrastructure.
The report dates the withdrawals from Sept. 29 through Oct. 1. The settlement contract was paused and reopened on Oct. 1, but affected routes stayed suspended and reopened gradually over the following days. Contract-side deposits resumed Oct. 2, according to the timeline.
A missing balance check
The exploit went undetected because monitoring compared assets on their origin chains with total NEAR-side token balances. It did not compare users' aggregate internal balances with the tokens the Intents contract actually held, the postmortem says.
The team says it has added that missing check and an automatic contract pause if the balances diverge.
A fix for the October exploit was deployed Oct. 2, but another critical bug report in the same feature prompted its complete removal on Oct. 7. Shevchenko said the team awarded the researcher $300,000.
Source: The Defiant
Trading involves risk.
Risk Disclaimer
