On 1 August 2022 the Nomad bridge lost about 190 million dollars after a routine upgrade marked a zero value as a trusted root. Because unused storage slots also read as zero, almost any message looked valid. The lesson is to test default values and treat upgrades as high risk.
What happened
According to the Immunefi analysis, an upgrade to Nomad's Replica contract was initialized with 0x00 as a pre-approved committed root. The initialize function stored that value in a mapping, so zero became a trusted root.
The process function decides whether a message is proven by reading a mapping. In Solidity, a key that was never written returns zero. So any message hash nobody had seen before resolved to the trusted zero root and was accepted as proven.
Why so many people took part
The first transaction drained about 100 WBTC, around 2.3 million dollars at the time. It needed no flash loan and no clever interaction with another protocol. A copier only had to change the recipient address in the message.
Once others understood the format, they replayed it with their own addresses. Immunefi calls the result a crowdsourced hack.
What the incident teaches
- Default values are inputs. A mapping lookup that has never been written returns zero, and zero can mean something dangerous if your logic treats it as valid.
- Test the empty case. Immunefi advises unit tests that cover zero and empty values.
- An upgrade is a deployment. A routine change introduced a flaw that exposed all locked funds, so upgrades deserve the same review as the original release.
- Secure the whole protocol, not only the core logic. Initialization code is part of the attack surface.
A review checklist for initialization
- List every value set in initialize or constructor code.
- For each, ask what happens if it is zero, empty or equal to an unset mapping entry.
- Write a test that submits a never seen input and expects rejection.
- Review upgrade diffs line by line, including configuration values, not just logic.
- Add monitoring that alerts on unusual outflow patterns so a bad deploy is noticed in minutes.
See also the rules for writing upgradeable contracts.
Quick check
Was this a flash loan attack?
No. Immunefi notes it required no flash loan or other complex interaction.
Did anyone get funds back?
Reporting at the time said some funds were returned by white hat participants, but check the project's own updates for current figures.
Sources
Last reviewed: 19 October 2026.
