In-Depth Analysis: zkLink Cross-Chain Protocol Attack Incident

According to the latest report from SlowMist Security Team, the cross-chain protocol zkLink recently suffered a security breach resulting in approximately $783,000 in losses. The incident centered around the exploitation of a transient storage vulnerability, highlighting potential risks in the verification mechanism design of cross-chain infrastructure.

Attack Methodology: Residual Values and Forgery

The attacker first initiated a legitimate cross-chain message operation, writing a verification value into the system's transient storage. This value should have been cleared immediately after the transaction, but due to a protocol design flaw, it remained accessible during subsequent calls within the same transaction.

In later operations, the attacker cleverly reused this residual verification value. Through interfaces provided by relay and gateway contracts, they successfully wrote a forged batch root. This counterfeit data was then used in the withdrawal verification process.

Core Mechanisms of the Security Vulnerability

Detailed analysis reveals the problem primarily existed in the following areas:

  • Missing Transient Storage Cleanup: Verification values were not strictly bound to the current call nor promptly cleared after execution
  • Insufficient Permission Verification: Batch root updates only checked gateway identity without independent validation of the data itself
  • Weak Contract Call Controls: Related contracts allowed relayers to specify external call targets and parameters, creating operational space for attackers

Exploiting these vulnerabilities, the attacker completed 12 unauthorized withdrawals within a single transaction, including 1 ETH withdrawal and 11 withdrawals of various ERC-20 tokens.

Cross-Chain Security Implications

This incident serves as another reminder that the security of cross-chain protocols depends not only on the strength of cryptographic primitives but also on the state management mechanisms of the entire system. Proper use of transient storage, lifecycle management of verification values, and multi-layer security checks are all essential components of building robust cross-chain infrastructure.

For project teams, beyond routine code audits, greater attention must be paid to the completeness of state machine design, particularly in scenarios involving cross-transaction state transfers. Meanwhile, establishing multi-layered defense systems to prevent single points of failure from compromising entire systems represents a crucial direction for future security architecture design.