What the primary account establishes
Nomad’s 5 August 2022 root-cause report describes an implementation bug in Replica that allowed forged, previously unprocessed messages to pass authentication. An unproven message read the default zero root from a mapping. Initialization had made that same zero root acceptable, combining a default state with a valid-state assumption. Fraudulent messages could then reach contracts relying on Replica for authentication.
The team’s subsequent recovery account dates the attack to 1 August 2022 and describes the operational challenge of many participating addresses, pending legitimate transactions and changing asset composition. Those reports are the basis for this retrospective. We have not independently reconstructed every transaction or assessed the bridge’s current deployment.
The failed boundary spans code and initialized state
Our analysis: a verification function cannot be reviewed in isolation from every way its storage is initialized and migrated. A value that means “not proven” in one mapping must not become “valid root” in another path without an explicit distinction. The important property is that processing a message requires evidence of its authorization, not merely a value that happens to satisfy a timeout check.
Treat zero values, legacy sentinels, empty trees and migration shortcuts as separate states in the design. Document which transitions make a message valid and which actors may trigger them. Review deployment scripts and upgrade inputs with the same security expectations as contract logic. A correct fresh deployment test can miss a failure introduced only when an older storage layout or historical root is carried forward.
Turn the case into a verification plan
On a local fork or isolated test environment, generate messages that have never been proven and require processing to fail across relevant initialization states. Include empty history, nonempty history, legacy values, duplicate messages and upgrades from supported old versions. Test the invariant directly: an unauthorized message cannot create a successful downstream action, regardless of how convenient the default storage value is.
Use sequence-based and property-based tests to exercise initialization, root updates, proof submission and processing in different orders. Verify final balances and state changes rather than only the return value of the proof helper. Review monitoring against the failure class: a system observing invalid root attestations may not detect a path that skips the expected attestation entirely.
Recovery is also an accounting problem
A bridge response must distinguish legitimate in-flight claims, forged messages and assets moved or exchanged after the event. Preserve identifiers and state snapshots before making emergency changes. Establish a controlled recovery address and communication process through independently verified channels. Avoid publishing a generic instruction that creates another opportunity for impersonated claims or malicious wallet approvals.
For a tabletop exercise, ask the bridge team to demonstrate who can pause which component, what the pause actually stops and how destination-chain activity is tracked afterward. Require a restart plan with evidence that the authentication invariant holds in the deployed state. Recovery promises should follow the verified accounting and governance process, rather than the assumption that patching one function restores every liability.
Controls to take away
- Initialization parameters are security-sensitive inputs.
- Default values need an explicit distinction from authorized state.
- A bridge code fix and asset reconciliation are separate recovery tasks.
Take this to your next review
Working checklist
Use this as a starting point, then assign owners and record evidence in your team's own system. Checks here reset when you leave or reload this note.
0 of 5 reviewed
Sources & further reading
Incident facts are attributed to the reports below. Controls and recommendations are our interpretation; this is not an independent forensic investigation.
A correction or a better primary source? Send Raiders the article URL and evidence. Editorial policy.