Authorization Flaw in GaslessReservoirEnabler Leads to $23,000 Loss
An authorization flaw in the GaslessReservoirEnabler contract allowed an attacker to drain funds from multiple token-holder addresses. The incident affected approximately 997 addresses, resulting in a total loss of $23,000.
The GaslessReservoirEnabler contract on Polygon experienced an authorization flaw that enabled an attacker to exploit the system. The flaw was located in the erc20WithTransfersAndExecute function, where it checked module addresses but failed to properly bind ERC-20 transferFrom calls to an authorized asset owner. This oversight allowed the attacker to spend the existing allowances of victims on whitelisted tokens, specifically WETH and ZED.
As a result of this vulnerability, around 997 token-holder addresses were drained, leading to a total loss of approximately $23,000. The attacker consolidated the stolen funds and subsequently deposited them into a bridge on Polygon. This incident highlights the risks associated with authorization mechanisms in smart contracts and the potential for significant financial loss when such flaws are present.
The on-chain record indicates that the stolen funds were moved through a bridge on Polygon, although specific addresses involved in the transaction are not provided. The incident underscores the importance of robust security measures in smart contract development to prevent similar exploits in the future.