NEAR Intents releases post-mortem on the October 1 vulnerability incident: $3.8 million in funds fully recovered, deposit notification feature removed

In a postmortem article published by Alex Shevchenko (@AlexAuroraDev), lead of NEAR Intents, a vulnerability was identified in the NEAR Intents contract's deposit notification mechanism when interacting with third-party contracts. The attacker deployed a contract that caused the notification call to fail, triggering the token contract to refund the deposits while the NEAR Intents contract retained the deposit records. Through 23 failed deposit transactions, the attacker generated approximately $3.8 million in "phantom funds," which were subsequently withdrawn to external chains via Omni infrastructure. This vulnerability resided in the NEAR Intents contract rather than in the Omni infrastructure. The timeline indicates the attack occurred between September 29 and October 1. The team detected withdrawal anomalies on October 1 and paused the contract within 29 minutes. Thanks to collaboration between the SHIELD security layer, on-chain tracking efforts, and industry security researchers, the attacker fully returned the funds on October 2, and all affected users have been compensated. The postmortem highlighted that existing monitoring only tracked discrepancies between aggregate token balances on the source chain versus NEAR, failing to monitor the mismatch between total user balances and contract token balances. This oversight allowed the attack to proceed undetected for several days. For remediation, the team has completely disabled the deposit notification functionality and implemented new monitoring for discrepancies between total user balances and contract balances. If this invariant is violated, the contract will automatically pause. On October 7, white hat research