Odaily News: The Sandbox has issued an update on the security vulnerability attack on the SAND cross-chain bridge, stating that attackers modified the verification mechanism and forged cross-chain deposit messages to mint unbacked SAND. The incident resulted in approximately 14.7423 million SAND being withdrawn, worth approximately $697,000. Additionally, some unbacked SAND was profited from through market trading, bringing the overall economic impact to approximately $1.497 million, of which the attacker actually obtained approximately $987,000.
For affected users, The Sandbox has committed to compensating wallets holding legitimate bridged SAND with SAND on the Ethereum chain at a 1:1 ratio, based on the on-chain snapshot taken before the attack. The compensation claim process is expected to open within two weeks and will remain open for two weeks.
The Sandbox stated that the attack did not affect the SAND supply on Ethereum or Polygon, with the total Ethereum SAND supply remaining unchanged at 3 billion tokens. No super admin privileges were compromised either. The attack stemmed from a vulnerability arising from the combination of a universal call function in the token contract and the bridge permission design. Currently, the relevant addresses have been flagged, and collaboration has been initiated with exchanges, security agencies, and the LayerZero team.
