The Nomad Bridge hack — $190M lost

function initialize(..., bytes32 _committedRoot, ...) public initializer {
    ...
    confirmAt[_committedRoot] = 1;   // upgrade passed 0x00 ⇒ confirmAt[0x00] = 1
}

function acceptableRoot(bytes32 _root) public view returns (bool) {
    uint256 _time = confirmAt[_root];
    if (_time == 0) return false;
    return block.timestamp >= _time;   // 0x00 → confirmAt = 1 → true, forever
}

function process(bytes memory _message) public returns (bool _success) {
    bytes32 _messageHash = keccak256(_message);
    // an un-proven message: messages[_messageHash] == bytes32(0)
    require(acceptableRoot(messages[_messageHash]), "!proven");   // ← always true
    ...
}
→ result: any message, from anyone, executed as if the bridge had signed it