Attacker drained 16.623 WETH (~$31K) on Base by exploiting an unverified contract's unrestricted external-call function to abuse an existing WETH allowance.
Security & Exploits ·
An attacker drained 16.623 WETH (approximately $31,000) on Base by exploiting a flaw in an unverified smart contract. The vulnerability lay in an unrestricted external-call function that allowed the attacker to invoke selector 0x42be3129, triggering the vulnerable contract to call WETH's transferFrom function. Because the victim had previously granted an approval to the contract, the full amount transferred without requiring the victim's signature on the exploit transaction itself.
The attack followed a chain from victim to vulnerable contract to a fresh helper address controlled by the attacker. A second attempt the following day yielded only zero-value transfers. The stolen funds remain in the attacker's wallet; the victim later requested return of 9 WETH and proposed the remainder as a white-hat bonus, but no refund has been confirmed.
The vulnerability highlights the risk of approving unverified contracts without scrutiny of their call mechanisms. Whether the attacker will respond to the white-hat offer or whether additional recovery methods exist remains unresolved.