Slice Exploit Leads to $41,000 Loss
Slice experienced an exploit in its FundsModule, resulting in a loss of $41,000. The attacker manipulated the system by using contracts that falsely reported asset transfers.
Slice, an on-chain commerce protocol, suffered an exploit in its FundsModule. The vulnerability was found in the 0x9d2edfac function, which trusted release amounts returned by caller-selected source contracts without verifying that the corresponding ETH or USDC was actually received. This oversight allowed the attacker to exploit the system.
The attacker utilized two contracts that reported nonzero amounts while transferring no assets. This manipulation enabled immediate withdrawals from pooled reserves, resulting in a loss of approximately $41,000 to the attacker. The exploit highlights a critical flaw in the verification process of asset transfers within the protocol.
The specific blockchain on which this incident occurred is not stated, which limits the ability to trace the transactions directly. However, the nature of the exploit suggests that the mechanism relied on the integrity of the contracts involved, which were compromised. The on-chain record does not provide specific addresses related to the exploit, focusing instead on the method of manipulation employed by the attacker.