Analysis of the $2.19 Million Asset Theft from Aztec Connect: ZK-Rollup Settlement Boundary Bypass Leads to L1/L2 State Discrepancy
Background
On June 14, 2026, the deprecated Aztec Connect RollupProcessor contract (0xff1f2b4adb9df6fc8eafecdcbf96a2b351680455) was exploited. The attacker constructed a boundary gap between numRealTxs and decoded_slots, extracting approximately $2.19 million worth of assets from the L1 pool in a single atomic transaction. Aztec Connect was deprecated in March 2024, but the immutable contract continues to be exposed to risk due to holding legacy user assets. This article reconstructs the complete technical details of the attack from two dimensions: contract source code and on-chain calldata.
Attack Overview
Root Cause of the Vulnerability
When the RollupProcessorV3 processes rollup settlement, there is a structural gap between the traversal range of the L1 settlement loop and the commitment range of the ZK public input hash. The attacker exploited this gap, so that the contents of 31/32 public input slots are committed to the L2 state root by the ZK proof without undergoing any settlement verification at the L1 contract layer.
Decoder.sol: numRealTxs is fully controlled by the attacker
numRealTxs is read from calldata offset 4516 and has no on-chain constraints:
decoded_slots is rounded up to a multiple of numTxsPerRollup, which is a requirement for the SHA256 precompile's data layout. However, this rounding operation creates a gap region between numRealTxs and decoded_slots that can be freely filled by the attacker.
RollupProcessorV3.sol: The settlement loop only covers numRealTxs slots
Breakdown of Security Assumptions
The security assumption under normal operation is that every public input slot either undergoes L1 contract layer verification (deduction of pendingDepositBalance upon deposit) or is constrained by the ZK circuit such that publicValue == 0. However, in this vulnerability scenario:
- The SHA256 precompile covers all 32 slots (actual input size: 8192 bytes = 32 × 256B), and the contents of the gap slots have already been committed to by the ZK proof.
- The L1 settlement loop only traverses the first 1 slot. The gap slots [2..32] are not subject to any verification at the L1 layer.
- The ZK circuit’s constraint that the gap slots’ publicValue should be 0 is either bypassed or not imposed by the attacker.
The three lines of defense depend on each other, but none of them alone can provide security for the gap slots — when the ZK circuit constraint is missing, the L1 contract layer also fails to detect the issue.
Dual-Path Divergence Model
The same calldata is consumed by two paths with different upper bounds:
The two paths have inconsistent perceptions of “which slots count” (the ZK recognizes 32 slots, while the L1 only recognizes 1 slot), which is precisely the root cause of the arbitrary minting.
Attack Process
The attack transaction 0x074ec931…aee1 contains a total of 14 processRollup() calls, structured in two phases as "first 7 mints + next 7 withdrawals," all completed within a single atomic transaction.
Phase 1: Minting — Arbitrarily obtaining assets on L2 (Rollup #13277–13283, 7 times)
1.The attacker EOA 0x0f18d8b44a740272f0be4d08338d2b165b7edd17 calls the main entry contract 0x06f585f74e0da633ae813a0f23fb9900b61d0fcd, triggering selector 0x6f3ce701.
2.The main contract sequentially dispatches to 3 relayer contracts, each hardcoding several malicious rollup calldata pieces. The key parameters of each calldata are:
numRealTxs = 1, rollupSize = 1024, numInnerRollups = 32
Slot 1 (visible to L1): proofId = 0 (noop), publicValue = 0
Slots 2–32 (31 gap slots, invisible to L1): proofId = 1 (deposit), publicValue = N, `publicOwner = attacker's L2 address
Accompanied by corresponding ZK proofs (the circuit does not constrain the gap slots’ publicValue to be 0)
3. Relayer contract A sequentially calls RollupProcessor.processRollup() (Rollup #13277–13281, 5 times):
The Verifier verifies the ZK proof successfully — the SHA256 commitment covers all 32 slots
The L1 settlement loop end = 1 × TX_PUBLIC_INPUT_LENGTH = 1 slot, only processing the noop
The forged deposits in gap slots [2..32] are committed by ZK into the new Merkle root → the attacker’s L2 balance gains 5 × 31N
4.Relayer contract B processes Rollup #13282–13283 (2 times) in the same manner, and the attacker’s L2 balance gains another 2 × 31N. At this point, the attacker's L2 account has accumulated a total of 7 × 31N in unsupported top-ups, while the L1 pool has not decreased by a single cent.
Phase 2: Withdrawal — Cashing out the inflated L2 balance into L1 assets (Rollup #13284–13290, 7 times)
The attacker uses 7 withdrawal rollups to convert the entire L2 balance obtained during the minting phase into L1 assets:
- Rollup #13284 (DAI):
withdraw()→ RollupProcessor directly transfers 270,513.054 DAI → 0x0f18…edd17 - Rollup #13285 (wstETH): transfers 167.890 wstETH → attacker
- Rollup #13286 (yvDAI): transfers 4,873.857 yvDAI → attacker
- Rollup #13287 (yvWETH, relayed by relayer contract C): transfers 16.570 yvWETH → attacker
- Rollup #13288 (LUSD): transfers 9,273.734 LUSD → attacker
- Rollup #13289 (yvLUSD): transfers 359.047 yvLUSD → attacker
- Rollup #13290 (ETH, final transaction): RollupProcessor transfers 908.987 ETH → attacker via internal CALL
The single atomic transaction executes successfully (gasUsed = 4,513,539), and the contract-level operation cannot be partially rolled back. The attacker nets approximately $2.19 million, all from the legitimate user asset pool of the RollupProcessor.
Fund Tracing
According to on-chain forensic tracking (as of 2026–06–15, approximately one day after the incident), the status of the stolen funds is as follows:
All assets were transferred from the RollupProcessor to the attacker’s EOA 0x0F18D8b44a740272f0be4d08338d2b165b7EdD17 within a single transaction via the intermediate attack contract 0x06f585…d0fcD. The intermediate contract holds no remaining funds.
Currently, 100% of the stolen funds remain intact at the attacker’s EOA and have not yet begun to be laundered.
Summary
The core lesson of this attack is that the settlement loop upper bound of a ZK-Rollup contract must be strictly aligned with the commitment range of the ZK public input hash. When there is a gap between the loop boundary numRealTxs at the L1 contract layer and the SHA256-committed decoded_slots, any security assumption that relies on the ZK circuit to impose constraints on the gap slots can be bypassed by an attacker—the L1 must independently verify every public input slot committed to by the ZK proof, rather than outsourcing the verification responsibility to the circuit layer.
SlowMist Security Team recommends that project teams conduct a comprehensive external security audit before deploying any Rollup system, with a focus on logical consistency at the L1/L2 state boundary, the trust boundary of calldata decoding, and on-chain secondary verification of ZK public inputs. For deprecated contracts that still hold legacy assets, it is advisable to perform an orderly asset migration or destruction to eliminate the risk of ongoing exposure.
This article was written by the SlowMist Threat Intelligence Team in conjunction with the MistEye Threat Intelligence System, the MistTrack Tracking Platform, and SlowMist Agent AI-driven analysis. For any questions, please feel free to contact us for feedback.
About SlowMist
SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.
SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.
By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.
