SlowMist reported that a Router contract was exploited due to security flaws in its Swap entry and uniswapV3SwapCallback, resulting in a loss of approximately 62.28 BNB. The Router failed to verify the caller as a legitimate V3 Pool and did not bind the payer in the callback to the original transaction context. Attackers forged a V3 Pool/adapter, injected the victim's address as the payer, and used the user's previously granted ERC-20 approval to the Router to execute transferFrom() to steal assets. Users who had approved sufficient tokens to the Router are at risk of having their authorized assets transferred even without further interaction.
SlowMist’s monitoring says a Router contract was exploited, with losses of about 62.28 BNB.
The attacker went after weak spots in the contract’s Swap entry and uniswapV3SwapCallback. Pretty direct. The Router did not check whether the caller was actually a legitimate V3 Pool, and it also failed to tie the payer in the callback to the original transaction context.
That opened the door. Attackers spun up a fake V3 Pool/adapter, slipped the victim’s address in as the payer, and then leaned on the existing ERC-20 approval users had already given the Router to trigger transferFrom() and move assets.
And the risk is not limited to active users. Anyone who approved enough tokens to the Router can still be exposed, even without making any further interactions.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
