Update on Aug 22, 2022:

Roughly $35 Million worth of funds have been returned by hackers, etherscan data shows.

Over $2 Billion has been lost in Q1 and Q2 along of 2022

2022 has been the most expensive year for web3 and it will remain that until next year, much like how the planet experiences the hottest year almost every new year.

Today’s letter is about Nomad Bridge hack. The number seems to vary but anywhere between $150M and $200M was lost to hackers as the bridge was drained. But the most intriguing thing about the hack is that not just hackers, but regular users were able to rob the bridge and now this incident is being deemed as “The First Decentralised Robbery ever”. Here’s how it all went down.

The Hack

Nomad

Tokens are locked in a smart contract on one chain and then issued on another chain as “wrapped” assets via such bridges.

In Nomad’s case, the smart contract where initially tokens are deposited was sabotaged.

On Twitter, @samczsun, a researcher at crypto investment firm Paradigm, explained that a recent update to one of Nomad’s smart contracts left a bug that allowed anyone to construct a cryptocurrency transaction in such a way to send a small amount of crypto on one side but receives a larger amount on the other side. You could literally send 0.1 BTC on one side and get 100 BTC on the other side.

samczsun @samczsun

1/ Nomad just got drained for over $150M in one of the most chaotic hacks that Web3 has ever seen. How exactly did this happen, and what was the root cause? Allow me to take you behind the scenes 👇

11:45 PM ∙ Aug 1, 2022

---

6,778Likes2,225Retweets

Now, this is where things get interesting. When such a loophole is identified, it’s almost always so that the exploiter will drain all the funds themselves. But, with Nomad, the hacker stole some money and others joined in to steal the rest of it for themselves.

The Robbery

The security gap in the new contract was, for the lack of a better word, blatant. As @samczsun pointed out, the Nomad contract did an improper initialization leading to the zero address (0x00) being marked as a trusted root, which led to every message being proven valid by default.

In short, the hacker could simply pass anything that is not in the system and the contract will process it. 100 WBTC withdrawal? Sure sir, coming up with a side dish of 100K USDC.

And once the exploit was, ummm… exploited by one, it didn’t take long for others to exploit it further. The hacker found the key to the lock, and then a lot of other people went after them to rob the store.

It didn't require a lot of expertise to replicate. @samczsun pointed out,

all you had to do was find a transaction that worked, find/replace the other person's address with yours, and then re-broadcast it,”

And that's exactly what people did.

How did such vulnerability make it into the contract?

We go to another expert, Twitter user @Zellic_io

It so happened that Nomad updated their contracts recently which made the past code vulnerable. When I worked in Tech, we had a saying for regression testing - testing all the things that worked before again, once new code is deployed. The saying was, “Regression should never be successful”. There is always something in the code that is being replaced or changed, that will make the old functionality fail.

So per @Zellic_io,

Why is confirmAt[0] set to 1? Well, it was set all the way back when the contract was deployed and initialized. This was benign until the later patch. 0 is a common default. But combined with the new code, led to a critical vuln(erability)

In the past, there were three possible messages that the contract was dealing with - 0 (invalid), 1(valid/proven) or 2 (processed).

In the later contract update, the transactions with statuses 1 and 2 were handled but there was no logic set for transactions with 0 addresses. Ideally, they should be handled as invalid.

And hence, the 0 transactions, aka invalid transactions were processed.

I wouldn’t have been able to hack this contract, and neither would 100s of 1000s of people who interact with smart contracts on a daily basis. But, someone was able to identify the bug and exploit it. This is what makes the space interesting and challenging. People are building a future where no single authority can control your digital assets. Hacks like these are a nuisance but they do help in making the security of contracts better for the future.

Nomad told CoinDesk it has notified law enforcement, and that its goal is to "identify the accounts involved and to trace and recover the funds."

Like in many cases, perhaps, the hackers would return the money to Nomad after securing a small amount as a bounty. But as of this writing, the entire contract of Nomad bridge is drained and it was drained by many individuals who participated in the first ever decentralized robbery.

FatMan @FatManTerra

Messages popping up in public Discord servers of random people grabbing $3K-$20K from the Nomad bridge - all one had to do was copy the first hacker's transaction and change the address, then hit send through Etherscan. In true crypto fashion - the first decentralized robbery.

foobar @0xfoobar

Nomad bridge getting actively hacked. WETH and WBTC being taken out in million-dollar increments. Withdraw all funds if you can, still $126m remaining in the contract that's likely at risk https://t.co/oDo7oT1glW

12:12 AM ∙ Aug 2, 2022

---

2,302Likes590Retweets

In Other World

Here are some of the happenings from the rest of the crypto universe:

1. 11 people from Forsage.io were charged with fraud for bilking retail investors in an alleged pyramid and Ponzi scheme. Read more on The Block

2. The Tether printers have been fired up again as the USDT circulating supply has started to tick up. Read more on CoinTelegraph

3. If you want to understand how Bridges work, here is an excellent writeup by Joel John - Read on Decetralised.co

Bridgeless Swaps:

In the last edition of the newsletter, we discussed Aave DAO’s approval for GHO stablecoin. Aave also laid out plans for e-mode and profiles, which would allow the movement of GHO across chains without the need for bridges. You can read about it here.

Speaking of stablecoins, Arkadiko Finance is building on that settles on the Bitcoin Blockchain. You can watch our interview with one of the co-founders Philip De Smedt below.

Industry Insights and Research:

1. Web 3.0 market to reach USD 81.5 Billion in 2030. Read the Full Report here.

2. Looking past the hype and critique, Web3 and the metaverse are shaping a new application layer for the internet. Read the Deloitte Report here.