NEAR Intents reveals $3.8 million vulnerability details, funds have been fully returned and users compensated

NEAR Intents has released a post event report, revealing that the previous withdrawal of $3.8 million in assets was due to a defect in the deposit notification function. The attacker exploited this vulnerability to generate false balances and extracted real tokens between September 29th and October 1st. NEAR Intents General Manager Alex Shevchenko stated that the vulnerability exists in the NEAR Intents contract. The attacker returned all funds within 36 hours after the vulnerability was discovered, and the affected users have received full compensation. The team has improved the monitoring mechanism and removed vulnerability features, and another security researcher has received a reward of $300000.