Curriculum·G201 Invariant Thinking·about 30 min
What an invariant is, and the one Nomad turned off
By the end of this lesson you can
- →Define a protocol invariant as a statement that must be true after every transaction, and give three examples for a system you use
- →State the Nomad invariant that was silently turned off, and why a default value made every unproven message read as proven
- →Compute how a single mistaken default converted a two-step validation into a one-step drain, and why 88 percent of the exploiting addresses were copycats
- →Write the one invariant a bridge, a lending market and a stablecoin each stake everything on
Graduate · enrolled learners
This lesson opens with The Nomad bridge, 1 August 2022.
- What happened
- In a routine contract upgrade Nomad set the value of a trusted message root to 0x00. On this bridge a message that has never been proven also carries a root of zero, so after the change every unproven message matched the trusted value and was treated as already proven. The Replica contract's process() function could be called directly, without the earlier prove() step, and it accepted any message. Once the first exploit transactions were public, others copied them, changed the recipient to their own address, and withdrew. An analysis by Coinbase's blockchain threat intelligence team found that 88 percent of the addresses conducting the exploit were copycats, who together took about 88 million dollars, while most of the valuable tokens went to just two of the original exploiters' addresses. The total drain was roughly 190 million dollars (Coinbase counted more than 186 million). By 5 August more than 22 million had been returned to Nomad.
- The decision point
- The bridge had one invariant that mattered above all others: a message is only processed after its validity is proven. That statement was never removed from anybody's mental model, and it was never enforced again after the upgrade, because the value that was supposed to mean trusted proof now matched the value that meant no proof at all. Nobody exploited a clever bug. They noticed that a promise the system was supposed to keep on every transaction had quietly stopped being kept, and then thousands of strangers copied the observation. The lesson for a user is that a protocol is a set of promises it claims will hold after every state change, and the first security question is not is the code clever but which promises is it making and what enforces each one.
- Recorded loss
- $190,000,000
What you will be able to answer
- →What is a protocol invariant?
- →How did Nomad turn off its invariant?
- →Why were 88 percent of the addresses that drained Nomad copycats?
- →The first question to ask of any protocol?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://medium.com/immunefi/hack-analysis-nomad-bridge-august-2022-5aa63d53814a
- https://www.halborn.com/blog/post/explained-the-nomad-hack-august-2022
- https://www.trmlabs.com/resources/blog/key-suspect-in-190m-nomad-bridge-exploit-extradited-to-the-united-states
- https://web.archive.org/web/20221002221230/https://www.coinbase.com/blog/nomad-bridge-incident-analysis
- https://decrypt.co/106820/nomad-recovers-ethereum-tokens-hack
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
Loss estimates for Nomad cluster around 190 million dollars (Immunefi and TRM say 190 million, Coinbase more than 186 million). The more than 22 million returned is Decrypt's report of Nomad's count on 5 August 2022. The split between original exploiters and copycats is Coinbase's: 88 percent of addresses, about 88 million dollars. It is a share of addresses, not of the loss.
Immunefi describes a routine April 2022 upgrade that passed 0x00 as a trusted root. Coinbase places it in two steps: the zero root was set when the Replica proxy was deployed on 21 April 2022, and became exploitable after a 21 June 2022 upgrade changed how process() checked messages. This lesson follows Immunefi's shorter account; the mechanism is the same.
J301 owns bridge architecture as a design question. This lesson owns the invariant framing and uses Nomad only for that. Keep the split.