zkLink Attack Exploits Transient Storage Vulnerability, Causing $783,000 Loss

Cross-chain protocol zkLink was attacked on October 29, resulting in losses of about $783,000. According to Odaily, the SlowMist security team said the attacker exploited a residual validation value in transient storage to forge a batch root used to verify withdrawals. The attacker made 12 withdrawals: one in ETH and 11 in ERC-20 tokens. The attacker first claimed a genuine cross-chain message to write the validation value, then reused it in a later call within the same transaction to forge the batch root through relay and gateway contracts. The contracts allowed relayers to specify external call targets and parameters, while the validation value was neither cleared nor bound to the current call; batch-root updates checked only the gateway’s identity and did not require independent proof verification.