BlockSec Identifies Aztec Vulnerability: numRealTxs Mismatch Allowed Creation of Unsecured Balances

AZTEC5.75%
According to BlockSec Phalcon, the Aztec vulnerability stemmed from numRealTxs in RollupProcessorV3 failing to bind with the transaction set enforced by zero-knowledge proofs. The vulnerability verification path decoded all transactions from encodedInnerTxData and inserted them into the rollup Merkle tree, while L1 settlement logic only processed the first numRealTxs decoded slots. Attackers exploited this mismatch by placing legitimate deposit transactions in later slots while setting numRealTxs to a lower value, bypassing checks like decreasePendingDepositBalance() and creating unsecured asset balances that were then withdrawn through normal redemption processes. The attack created unsecured balances across multiple assets simultaneously.
Disclaimer: The information on this page may come from third-party sources and is for reference only. It does not represent the views or opinions of Gate and does not constitute any financial, investment, or legal advice. Virtual asset trading involves high risk. Please do not rely solely on the information on this page when making decisions. For details, see the Disclaimer.
Comment
0/400
No comments