TechFlow reports that on June 15, SlowMist released a technical analysis stating that the deprecated Aztec Connect RollupProcessor contract was exploited via a settlement boundary bypass vulnerability, resulting in the theft of approximately $2.19 million worth of assets from the protocol. The attacker leveraged a mismatch between numRealTxs and decoded_slots to forge deposits and induce inconsistency between L1 and L2 states, thereby bypassing L1 settlement validation and completing the fund transfer. The report also discloses the root cause of the vulnerability, on-chain fund flows, and the attack execution path.
Add to Favorites
Share to Social Media
