Nimiq Swap Contract Attacked on Polygon, Losing About $504,000

Nimiq's swap contract was attacked on Polygon on September 16, resulting in losses of about $504,000. According to Foresight News, Nimiq said it has suspended all stablecoin transactions using gas fee abstraction in Nimiq Pay and Nimiq Wallet while it investigates security issues related to OpenGSN. The attacker exploited a vulnerability in the contract's execute() function, which did not verify user signatures. By forging open() requests from a liquidity wallet, the attacker opened multiple HTLCs and withdrew all USDC, USDT0, and USDC.e from them, with the assets eventually consolidated into USDC.