PANews October 17 news: NEAR Intents has released a security incident report for October 1. Its smart contract had a vulnerability related to interactions with third-party contracts. The attacker exploited the refund mechanism after a failed call, causing funds to be returned while deposits were still recorded. Through 23 failed deposit transactions, approximately $3.8 million in false balances were generated, and the funds were subsequently withdrawn via the Omni cross-chain infrastructure. This was a vulnerability in the NEAR Intents contract itself, not a vulnerability in the Omni infrastructure. Within 36 hours of discovering the vulnerability, all funds were fully recovered. The team has removed the relevant deposit notification feature, introduced abnormal balance monitoring and automatic pause mechanisms, and paid a $300,000 bounty to the researcher who reported another critical vulnerability in the same feature on October 7. The system has now returned to normal.
PANews October 17 news: NEAR Intents has released a security incident report for October 1. Its smart contract had a vulnerability related to interactions with third-party contracts. The attacker exploited the refund mechanism after a failed call, causing funds to be returned while deposits were still recorded. Through 23 failed deposit transactions, approximately $3.8 million in false balances were generated, and the funds were subsequently withdrawn via the Omni cross-chain infrastructure. This was a vulnerability in the NEAR Intents contract itself, not a vulnerability in the Omni infrastructure. Within 36 hours of discovering the vulnerability, all funds were fully recovered. The team has removed the relevant deposit notification feature, introduced abnormal balance monitoring and automatic pause mechanisms, and paid a $300,000 bounty to the researcher who reported another critical vulnerability in the same feature on October 7. The system has now returned to normal.