ZetaChain admits overlooking bug bounty report before $334K exploit

ZetaChain has acknowledged that a vulnerability behind its recent exploit had already been reported through its bug bounty program, but was treated as expected behavior.

According to ZetaChain’s post-mortem published Wednesday, the incident has triggered an internal review of how the protocol evaluates bug bounty submissions, especially those involving multi-step attack paths that may appear harmless when viewed separately.

The disclosure follows an attack on Sunday that targeted the project’s cross-chain gateway contract, draining about $334,000 across nine transactions on Ethereum, Arbitrum, Base, and BSC, all from wallets controlled by the team. 

ZetaChain stated that no user funds were impacted, a point it had also emphasized a day earlier when it paused cross-chain transactions on its mainnet to contain the breach.

DefiLlama data had earlier estimated the losses at roughly $300,000, while ZetaChain said at the time that it would release a full breakdown after completing its investigation.

Flaws combined to enable full drain

ZetaChain said the attacker chained together three separate design weaknesses that, on their own, did not appear critical but together enabled the exploit. The gateway contract allowed unrestricted cross-chain instructions to be sent, while the receiving side executed nearly any command on any contract, with a limited blocklist that failed to cover basic token transfer functions.

Existing wallets that had interacted with the gateway retained unlimited token approvals, which were not revoked. By combining these conditions, the attacker instructed the gateway to move tokens from those wallets, and the system executed the transfers without resistance.

“This was not an opportunistic attack,” ZetaChain said, outlining how the attacker prepared in advance by funding a wallet through Tornado Cash three days before the exploit, deploying a custom drainer contract on ZetaChain, and running an address poisoning campaign before initiating the transactions.

Bug report dismissed before exploit

In its post-mortem, ZetaChain confirmed that the core issue had been raised earlier through its bug bounty program but was not treated as a threat at the time. The team said this has prompted a reassessment of how it handles reports that describe complex attack combinations rather than isolated bugs.

“This bug was reported and they simply ignored it,” one user wrote on X, adding that current bug bounty structures often fail to reward researchers for identifying vulnerabilities before they are exploited.

Following the incident, ZetaChain said it has disabled the gateway’s arbitrary call functionality through a patch being rolled out to mainnet nodes. The platform has also removed unlimited token approvals from its deposit process, replacing them with exact-amount approvals to reduce risk from similar attack patterns.