Nomad Bridge incident, 2022-08-01

Nomad's Replica contract accepts a message only if it belongs to a "root" that has been confirmed. Roots are stored in a mapping, and in Solidity any unset key reads as zero. During the June 2022 upgrade the contract was initialised with the zero root marked as confirmed. After the upgrade changed how process checked messages, an unknown message hash looked up its root, got zero, and zero was trusted — so any message passed (Immunefi; Nomad).

What made Nomad unique was the copying. Exploiting it required no keys and no skill: take a successful attack transaction, replace the recipient with your own address, and submit it. Coinbase's analysis shows hundreds of addresses replaying almost identical payloads (Coinbase). A bridge drained by a crowd cannot be stopped by blacklisting one attacker; only a pause can, and Nomad had no fast pause in place.

The upgrade was audited, but initialisation values are easy to overlook. Invariant tests ("an unproven message must never be processed") and a pause controlled by a separate guardian are the controls that address this class.

Copycat attacks also complicate recovery: funds end up in hundreds of wallets, some anonymous and some not, and each holder has to be persuaded separately to return them. That is why Nomad's recovery depended on appeals to white-hats rather than on any single negotiation.

At the time

Once the exploit was public, nothing a depositor did could save the locked funds. Holders of Nomad-bridged tokens on other chains could have swapped them to native assets in the first hours, before markets repriced them — but that also transferred the loss to whoever bought.

Now

Prefer bridges that have an emergency pause held by an independent party and a public record of how they handle upgrades. L2Beat risk cards list upgrade delays and pause powers; ours cite them. Avoid holding large balances of bridged tokens whose backing depends on a single bridge contract.