$POL Nimiq Exploited on Polygon: $504K Loss from Signature Verification Flaw
Nimiq's swap contract on Polygon was exploited on September 16, with losses around $504,000. This wasn't a sophisticated hack, it was a basic but costly mistake.
How it happened:
The attacker exploited a flaw in the contract's execute() function, which didn't verify user signatures. They spoofed an open() request from the liquidity wallet, opened multiple HTLCs (Hashed Time-Locked Contracts), and drained all USDC, USDT0, and USDC.e. The proceeds were consolidated into USDC.
Nimiq's response:
Paused all gas-paid stablecoin transactions in Nimiq Pay and Nimiq Wallet
Investigating a security issue related to OpenGSN
The key point here: the vulnerability wasn't in Nimiq Chain or Nimiq Pay, it was in a third-party integration layer: OpenGSN.
OpenGSN (Gas Station Network) lets users pay gas with alternative tokens instead of the network's native token. It's a common utility, but also a new attack surface.
The core problem: if execute() doesn't verify user signatures before execution, anyone can spoof requests. It's a basic flaw but in DeFi, basic flaws often cause major damage.
Compared to larger hacks, $504K isn't huge. But it's a reminder that not every exploit requires advanced technique. Sometimes one missing check is enough.
Lesson for projects: when integrating any third-party layer especially around signatures and authentication audit the verification logic carefully. And always have a fallback to pause the system when things go wrong.
What do you think should projects limit reliance on third-party integration layers to reduce attack surface?
News is for reference, not investment advice. Please read carefully before making a decision.
Nimiq's swap contract on Polygon was exploited on September 16, with losses around $504,000. This wasn't a sophisticated hack, it was a basic but costly mistake.
How it happened:
The attacker exploited a flaw in the contract's execute() function, which didn't verify user signatures. They spoofed an open() request from the liquidity wallet, opened multiple HTLCs (Hashed Time-Locked Contracts), and drained all USDC, USDT0, and USDC.e. The proceeds were consolidated into USDC.
Nimiq's response:
Paused all gas-paid stablecoin transactions in Nimiq Pay and Nimiq Wallet
Investigating a security issue related to OpenGSN
The key point here: the vulnerability wasn't in Nimiq Chain or Nimiq Pay, it was in a third-party integration layer: OpenGSN.
OpenGSN (Gas Station Network) lets users pay gas with alternative tokens instead of the network's native token. It's a common utility, but also a new attack surface.
The core problem: if execute() doesn't verify user signatures before execution, anyone can spoof requests. It's a basic flaw but in DeFi, basic flaws often cause major damage.
Compared to larger hacks, $504K isn't huge. But it's a reminder that not every exploit requires advanced technique. Sometimes one missing check is enough.
Lesson for projects: when integrating any third-party layer especially around signatures and authentication audit the verification logic carefully. And always have a fallback to pause the system when things go wrong.
What do you think should projects limit reliance on third-party integration layers to reduce attack surface?
News is for reference, not investment advice. Please read carefully before making a decision.
