Behodler's PyroWETH10 token drained for $6.4K via broken access control in transferFrom allowing unlimited approvals to be exploited without recipient consent.
Security & Exploits ·
Behodler's PyroWETH10 token experienced a loss of $6.4K on Ethereum after an attacker exploited a flaw in the token's transferFrom function. The vulnerability stemmed from broken access control logic that checked the recipient's allowance rather than the spender's—allowing an attacker to transfer tokens from victims without obtaining prior approval. Because holders had granted unlimited allowances to the PyroWethProxy contract for routine deposits and redemptions, the attacker could move approximately 3.57 ETH in PyroWETH10 from victim accounts to the proxy, then trigger a redeem function to withdraw the assets.
The mechanics of the exploit centered on the discrepancy in how the token validated spending rights. The transferFrom function verified _allowances[sender][recipient] instead of the correct _allowances[sender][msg.sender], inverting the permission check. This flaw meant that as long as the destination address held an approval—which the proxy did—any caller could drain tokens from any holder without needing the attacker's own approval. The stolen tokens were then redeemed through the proxy contract to extract WETH10.
The incident revealed a critical gap in the token's authorization framework, though details about whether the contract has been patched, whether additional victims exist, or how Behodler plans to address the vulnerability remain unclear.