NEAR Intents $3.8M deposit-notification exploit postmortem
Analysis
Security & GovernanceZero-Storage Verticals
intentsrisksecuritynearghost-fundsasync-callbacks
What happened
A deposit-notification feature in the NEAR Intents contract let an attacker create $3.8M of unbacked ledger credit ("ghost funds") across 23 deliberately-failing deposits, then withdraw real tokens via Omni. All funds returned within 36 hours; feature removed Oct 7 after a second critical report; $300k bounty paid.
Why it matters for us
- Which stream: Stream 3 (Governance/intents) and Stream 9 (zero-storage intent solvers, escrow).
- Which decision: Any intent/escrow contract we build must not credit deposits before the token movement is final; add an aggregate-user-balance vs contract-balance invariant with automatic pause. Async callback gaps are the attack surface.
What to do next
Rec 1: Add an invariant check (sum user balances == contract token balance) with auto-pause to any escrow/intent contract spec.
Rec 2: Prefer execute-path deposits over notification callbacks; treat all cross-contract callbacks as untrusted.