SlowMist disclosed a smart contract security incident involving the GaslessReservoirEnabler contract, saying a flaw in its erc20WithTransfersAndExecute function allowed an attacker to move about $23,000 worth of WETH and ZED. According to the security firm, the issue stems from the _executeInternal function, which checked the module address but did not bind ERC20 transferFrom instructions to the authorized asset owner. That design let any caller spend an existing allowance from victims as long as the token was on the whitelist. SlowMist said the attack affected 997 token holder addresses. It identified the attacker address as 0x46f54c1a86575679fc3d29666c1717e9786279aa and the affected contract as 0x9b58fdadc16e30fba313e044bf9e88689c3f163e. The stolen funds have since been consolidated and deposited into a cross-chain bridge on Polygon, according to the disclosure cited by Techub News.
SlowMist has disclosed a smart contract security incident involving the GaslessReservoirEnabler contract. The firm said a vulnerability in the contract’s erc20WithTransfersAndExecute function was used to move about $23,000 in WETH and ZED.
Where the flaw was found
According to SlowMist, the root cause lies in the _executeInternal function. While the function checked the module address, it did not bind ERC20 transferFrom instructions to the authorized asset owner.
That left a path for any caller to spend a victim’s existing allowance through whitelisted tokens.
Affected addresses and fund movement
The attack involved 997 token holder addresses. SlowMist identified the attacker address as 0x46f54c1a86575679fc3d29666c1717e9786279aa, while the affected contract address was 0x9b58fdadc16e30fba313e044bf9e88689c3f163e.
The stolen funds have been consolidated and deposited into a cross-chain bridge on Polygon, according to the disclosure.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
