Curriculum·G201 Invariant Thinking·about 30 min
What an invariant is, and the one Nomad turned off
By the end of this lesson you can
- →Define a protocol invariant as a statement that must be true after every transaction, and give three examples for a system you use
- →State the Nomad invariant that was silently turned off, and why a default value made every unproven message read as proven
- →Compute how a single mistaken default converted a two-step validation into a one-step drain, and why 90 percent of the loss was copycats
- →Write the one invariant a bridge, a lending market and a stablecoin each stake everything on
Graduate · enrolled learners
This lesson opens with The Nomad bridge, 1 August 2022.
- What happened
- In a routine contract upgrade Nomad set the value of a trusted message root to 0x00. On this bridge a message that has never been proven also carries a root of zero, so after the change every unproven message matched the trusted value and was treated as already proven. The Replica contract's process() function could be called directly, without the earlier prove() step, and it accepted any message. The first attacker copied a legitimate transaction, changed the recipient to their own address, and withdrew. A postmortem by Coinbase's blockchain intelligence team found that about 90 percent of the addresses that followed were copycats replaying the same call with minimal variation, a crowdsourced drain of roughly 190 million dollars. White-hat actors later returned more than 22 million.
- The decision point
- The bridge had one invariant that mattered above all others: a message is only processed after its validity is proven. That statement was never removed from anybody's mental model, and it was never enforced again after the upgrade, because the value that was supposed to mean trusted proof now matched the value that meant no proof at all. Nobody exploited a clever bug. They noticed that a promise the system was supposed to keep on every transaction had quietly stopped being kept, and then thousands of strangers copied the observation. The lesson for a user is that a protocol is a set of promises it claims will hold after every state change, and the first security question is not is the code clever but which promises is it making and what enforces each one.
- Recorded loss
- $190,000,000
What you will be able to answer
- →What is a protocol invariant?
- →How did Nomad turn off its invariant?
- →Why were 90 percent of the Nomad losses copycats?
- →The first question to ask of any protocol?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://medium.com/immunefi/hack-analysis-nomad-bridge-august-2022-5aa63d53814a
- https://www.halborn.com/blog/post/explained-the-nomad-hack-august-2022
- https://www.trmlabs.com/resources/blog/key-suspect-in-190m-nomad-bridge-exploit-extradited-to-the-united-states
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
Loss estimates for Nomad cluster around 190 million dollars, with the recovered figure above 22 million; the exact split between the original attacker and copycats is from Coinbase's analysis and is cited as such.
J301 owns bridge architecture as a design question. This lesson owns the invariant framing and uses Nomad only for that. Keep the split.