Wanchain's Cardano cross chain bridge attacked, 515 million NIGHT stolen

BlockSec monitoring shows that Wanchain's Cardano cross chain bridge was attacked, and 515 million NIGHT tokens were stolen from the cross chain bridge vault. The investigation shows that there is a problem with the encoding of non singleton signature messages in the Treasury Check validator, which results in different combinations of field values producing the same byte string, thus reusing hashes and valid signatures. BlockSec verified this vulnerability by decompiling the Plutus V2 bytecode on the chain and decoding the redemption data of the attack transaction.