WAX’s eth.token::withdraw function failed to validate that max_fee was nonnegative. By setting max_fee = -quantity, the attacker reduced the total account debit to zero while retaining the full withdrawal amount. Because the configured withdrawal fee was zero, the fee check did not reject the transaction. The resulting withdrawal logs triggered real payouts from the bridge on Solana and Ethereum

The WAX Multi-Chain Bridge (spanning WAX, Solana, and Ethereum) was exploited due to a smart contract logic flaw. The eth.token::withdraw function failed to enforce max_fee ≥ 0 before debiting; the attacker set a negative max_fee equal to -quantity, zeroing the debit while still generating a full withdrawal log and bridge records. This triggered corresponding asset releases on Solana and Ethereum, resulting in a loss of approximately $90,500. Officials confirmed the issue was limited to a bridge contract (stablecoins affected; WAXP and the main chain unaffected) and paused bridge processing.