# Aurora Inflation Spend Bugfix Review: $6m Payout

DELEGATECALL to Aurora's ExitToNear precompile inherited msg.value without sending ETH, minting nETH on NEAR and doubling attacker balance repeatedly.

- Payout: $6,000,000
- Severity: critical
- Program: Aurora
- Credited: pwning.eth
- Disclosed: 2022-06-07
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/aurora-inflation-spend-bugfix-review-6m-payout/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-inflation-spend-bugfix-review-6m-payout
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic

**Target:** Aurora Engine precompiled ExitToNear/ExitToEthereum contracts and Rainbow Bridge
**Root cause:** The engine only checks that an ExitToNear log was emitted from the hardcoded precompile address and assumes msg.value>0 means ETH was actually sent; DELEGATECALL inherits msg.value from the caller context without transferring ETH to the precompile.
**Steps:**
1. Bridge ETH from Ethereum to Aurora via Rainbow Bridge
2. Deploy malicious contract on Aurora that DELEGATECALLs ExitToNear at `0xe9217bc70b7ed1f598ddd3199e80b093fa71124f`
3. Call exploit function; engine emits ExitToNear event and schedules nETH transfer to caller on NEAR while attacker's Aurora balance is unchanged
4. Deposit received nETH back into Aurora via Aurora Bridge, doubling balance
5. Repeat from step 3
**How found:** Researcher analyzed how Aurora Engine's filter_promises_from_logs trusts logs from the hardcoded ExitToNear/ExitToEthereum addresses and assumes msg.value>0 implies ETH was sent; realized DELEGATECALL preserves msg.value from the outer context without transferring ETH, so the precompile logic could be invoked without payment.
**Exploitation:** Attacker bridges ETH to Aurora, then repeatedly DELEGATECALLs the ExitToNear precompile from a malicious contract so the engine schedules nETH payouts on NEAR without debiting Aurora balance; nETH is redeposited to Aurora to double balance each cycle, potentially draining 70k ETH and $200m in assets.
**Escalation:** Looping the delegatecall-and-redeposit cycle compounds balance exponentially, enabling drain of all bridge-held ETH and ERC20 assets.
**Insight:** When a bridge or precompile trusts msg.value or log origin as proof of payment, test DELEGATECALL: it preserves msg.value from the caller context while no ETH moves, letting you forge deposit/exit events without funding them.