Nimiq's swap contracts exploited for $50.4K on Polygon via signature verification bypass in OpenGSN paymaster integration.
Security & Exploits ·
Nimiq's swap contracts on Polygon were exploited for $50.4K on September 16, 2026, through a signature verification bypass in their OpenGSN paymaster integration. The vulnerability stemmed from the swap contracts serving dual roles as both paymaster and forwarder while their execute() function failed to verify user signatures, instead relying on an internal preRelayedCall function for validation.
The attacker leveraged OpenGSN's architecture, which permits any relay to select arbitrary paymasters and forwarders. They staked 1 POL, registered an EIP-7702 EOA as relay manager, worker, and an accept-everything paymaster, then set the forwarder to point to HTLC handlers. By skipping signature checks, the attacker forged requests purporting to originate from a swap-liquidity wallet with unlimited token approvals, opening HTLCs for the entire USDC, USDT0, and USDC.e balances with the attacker's precomputed CREATE2 contract as recipient and a fixed hashlock.
The exploit transaction deployed the attacker's contract and redeemed all three HTLCs using the known hashlock secret, consolidating approximately $50.4K in USDC. The vulnerability was detected by Defimon 19 minutes before the attack occurred, though this advance warning did not prevent the theft.