According to ChainCatcher, BlockSec Phalcon (@Phalcon_xyz) analyzed that Aztec Network's RollupProcessorV3 contract was attacked, resulting in losses exceeding $2.15 million. The root cause was that numRealTxs was not effectively bound to the transaction set enforced by ZK proofs, causing a discrepancy between the proof verification path and the L1 settlement logic's interpretation of the transaction list.
Attackers exploited this vulnerability to move real deposits to slots that were not processed by the settlement logic, bypassing the decreasePendingDepositBalance() function, creating unsecured private balances out of thin air, and then withdrawing them through the normal settlement process. A total of seven types of assets were involved.
