Nimiq

What happened

Nimiq’s Polygon swap contracts served as OpenGSN forwarders while relying on their own preRelayedCall path to authenticate requests rather than independently verifying the user’s signature inside execute(). An attacker registered an EIP-7702 EOA as an OpenGSN relay manager, relay worker and permissive paymaster, then selected Nimiq’s HTLC handlers as the forwarders. This allowed forged open() requests purportedly originating from a partner liquidity wallet to reach the handlers without the expected signature validation. Because that wallet had existing token approvals to the handlers, HTLCs were opened using its USDC, USDT0 and USDC.e, with the attacker-controlled contract as recipient, and subsequently redeemed by the attacker

Details

Date

Sep 16, 2026

Kind

Hack or exploit

Method

Signature Verification Flaw

How in

Smart contract bug

Target

DeFi protocol

Chains

Polygon

Reported by

• DefiLlama ↗
• SlowMist Hacked ↗

Related incidents