NEAR Intents general manager Alex Shevchenko has published a technical account of the exploit detected on October 1. Deposits were refunded without reversing users’ credited balances, creating $3.8 million in unbacked entries across 23 transactions.
NEAR Intents general manager Alex Shevchenko attributed the $3.8 million exploit detected on October 1 to a deposit-notification bug in a technical report published on October 16. The team said the attacker returned all withdrawn funds on October 2 and affected users were made whole.
The feature notified another smart contract on NEAR when tokens were deposited. The attacker deployed a receiver contract that made these calls fail. The token contract refunded the deposit, but Intents retained the corresponding user credit. According to the report, 23 failed deposits created $3.8 million in unbacked balances, which the attacker used to withdraw real assets held by the contract.
The flaw was in the balance records: The report identifies Omni as the route used to move the funds to another chain. The NEAR Intents contract created the unbacked credit.
Monitoring missed the internal balance mismatch
The team monitored assets on their origin chains against the corresponding total token balances on NEAR. It did not compare the aggregate balances credited to Intents users with the tokens actually held by the Intents contract.
The report places the withdrawals between September 29 and October 1. Withdrawal problems were identified on October 1, and the contract was paused 29 minutes later. It resumed later that day, while affected transfer routes returned gradually over the following days.
The funds were returned after tracking transactions on public chains and negotiations with the attacker. Shevchenko says users were made whole within 36 hours of detection. The mainnet fix went live on October 2, and contract-side deposits resumed seven minutes later.
Deposit notifications removed; automatic pause added
A flaw reported in January in a similar feature had been fixed within two days and was not exploited. Another critical report concerning deposit notifications arrived on October 7, prompting the team to remove the feature entirely. It said researcher Rohan Ganapa received $300,000 through its bug bounty program for that latest report.
A new check compares aggregate user balances with the contract’s token balance and automatically pauses the contract if they diverge. The team also continues to develop its SHIELD security layer. SHIELD’s documentation distinguishes live quote-time checks from broader bridge and transaction-monitoring functions still being rolled out.
NEAR’s formal verification explainer published on October 16 describes work toward mathematical proofs that software follows specified rules. It says those proofs are limited by their chosen properties and assumptions and complement testing and code review. No completed verification result for the entire Intents contract, or completion date, was announced.
Alex Shevchenko’s October 16 technical postmortem
The post loads from X when you open it.
