Blockaid detects ongoing exploit of WAX multi-chain bridge across WAX, Solana and Ethereum

Security firms Blockaid and SlowMist report an ongoing exploit of the WAX multi-chain bridge across WAX, Solana and Ethereum, with losses of about $90.5K. The attacker exploited a fee-validation flaw: WAX's eth.token::withdraw failed to enforce max_fee ≥ 0 before debiting, letting the attacker set max_fee = -quantity to reduce the debit to zero while preserving the full withdrawal, triggering releases on Solana and Ethereum.

Detected & updated continuously · Source: Nebula