Sam Sun, a researcher at crypto investment firm Paradigm, explained on Twitter that a recent update to one of Nomad’s smart contracts made it easy for users to spoof transactions, meaning people could withdraw money from the bridge that didn’t actually belong to them.
