SlowMist’s security team said an unverified contract was exploited after exposing an unrestricted low-level call tied to selector 0x42be3129, resulting in the theft of about 16.6 WETH. The team said the contract lacked both access control and validation of target data, leaving a path for abuse. According to SlowMist, the attacker took advantage of an existing ERC20 allowance granted to the contract and bypassed owner checks to carry out unauthorized transferFrom operations. The incident highlights a contract-level flaw identified in monitoring rather than a broader protocol issue, based on the details provided in the alert.
According to SlowMist’s security team, an unverified contract exposed an unrestricted low-level call through selector 0x42be3129, leading to the theft of about 16.6 WETH.
SlowMist said the contract lacked access control and target data validation. The attacker used an existing ERC20 allowance on the contract to bypass owner checks and execute unauthorized transferFrom operations.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
