NEAR Intents Discloses $3.8M Exploit, Confirms Full Recovery
TREE NEWS reports: NEAR Intents has published a detailed post-mortem of an October 1 security incident in which an attacker exploited a flaw in its smart contract’s token deposit logic to generate fraudulent deposits totaling roughly $3.8 million. The vulnerability surfaced when the deposit contract called an external third-party contract during token deposits. When that external call failed, the protocol’s refund mechanism returned the user’s funds — but the deposit was still recorded on the books. The attacker weaponized this mismatch across 23 transactions, crediting balances that were never actually backed by transferred assets.
The disclosure confirms that all funds have since been recovered, a rare full-circle outcome in DeFi exploit history, where recovery rates remain low and most incidents end in permanent losses for users or the protocol treasury.
How the Attack Worked
The core issue is a classic accounting desynchronization pattern: state updates and asset transfers fell out of sync when a downstream call reverted. Instead of atomically rolling back the deposit record, the contract issued a refund while leaving the internal balance credited. This let the attacker mint claims on the protocol without delivering corresponding collateral — effectively a free-mint primitive limited only by how many times the loop could be repeated.
- Root cause: Non-atomic handling of failed external calls during deposits
- Attack surface: Third-party contract integration in the deposit path
- Scale: 23 transactions generating fraudulent deposit records
- Outcome: Approximately $3.8M affected; 100% recovered
Industry Implications
Cross-chain intent systems like NEAR Intents are among the most integration-heavy designs in DeFi, routing user assets through solvers, bridges, and third-party contracts. That composability is precisely what makes them powerful — and what makes refund and fallback logic a high-risk zone. The incident reinforces a lesson the industry has learned repeatedly since the Euler and Nomad exploits: any code path that touches external contracts must preserve atomicity between value transfer and state mutation, or explicitly reconcile discrepancies before finalizing balances.
The full recovery also highlights the growing maturity of incident response. Rapid on-chain tracing, coordinated outreach to exchanges and bridges, and negotiation with the attacker have turned several recent exploits into recoverable events rather than total write-offs — a meaningful shift in incentives, though one that still depends heavily on the attacker’s willingness to return funds.
What to Watch Next
Expect NEAR Intents to tighten deposit finality rules, add reentrancy and revert-handling guards, and expand monitoring for anomalous deposit patterns. More broadly, the case adds pressure on intent-based architectures to standardize how failed cross-contract calls are settled. As intent rails compete to become the default UX layer for cross-chain liquidity, security audits focused specifically on refund and fallback logic — not just core math — will become a baseline expectation rather than a differentiator.
