🚨SlowMist TI Alert🚨 💸 @zkLink_Official Loss: ~783.1k 🔍 Root Cause: Arbitrator.claimMessage failed to clear the transient finalizeMessageHash and require a fresh authenticated callback for each invocation. Through the publicly callable, authorized SyncL2TxHashRelayer, the attacker first populated a valid hash, then reused it while substituting EthereumGateway.sendMessage as the claim target. This executed ZkLink.syncBatchRoot under the legitimate gateway identity, installed an attacker-chosen l2LogsRootHashes root, and withdrew assets using forged proofs. 📌 Attacker: 0xaca0655a11200a80d33d0e48786317304cde5718, 0xDAB137F390dF77caA97fd492540E973fd5e2F8c8 📌 Victims: ZkLink 0x5fd9f73286b7e8683bab45019c94553b93e015cf; L1ERC20Bridge 0xad16edcf7deb7e90096a259c81269d811544b6b6 📌 Vulnerable Contract: Arbitrator 0x1ee09a2caa0813a5183f90f5a6d0e4871f4c6002 (implementation: 0x7a0bb4805ecb7fd3c8dabbe4afa0e91cb1761e34) Powered by http://SlowMist.AI Tx: https://etherscan.io/tx/0x4f3c23e75b9134e8cae5a462550daad42fbbc19242567fcc34c0a035e297462c https://etherscan.io/tx/0x8a7e38b9c2a7a40981317ba87fbaa2e50527ec412cefc2fb4c9e3184f8848ae9