ZetaChain Dismissed Bug Report That Could Have Prevented $334K Exploit

ZetaChain has acknowledged that a vulnerability exploited for a $334,000 loss was previously reported through its bug bounty program but was dismissed as intended behavior. The incident has led the platform to review its bug bounty submission process, particularly for chained attack vectors. The attacker exploited three design flaws: unrestricted arbitrary cross-chain instructions, a permissive execution on the receiving end, and lingering unlimited spending permissions on previously used wallets. By combining these, the attacker was able to transfer tokens from victim wallets to their own. ZetaChain stated the attack was premeditated, with the attacker using Tornado Cash and deploying a dedicated drainer contract. A patch disabling arbitrary call functionality is being rolled out, and unlimited token approvals have been replaced with exact-amount approvals.

(Source：Cointelegraph)