Foxify.trade USDC vault on Arbitrum drained via role ID collision in Factory contract allowing direct Storage writes; factory upgraded to split roles with distinct bit layouts.
Security & Exploits ·
A USDC vault on Arbitrum operated by Foxify.trade was drained through a role ID collision in the Factory contract that deployed markets permissionlessly. The vulnerability allowed an attacker to create a market, receive a user role with storage privileges, and directly manipulate vault balances by calling Storage contract functions. Foxify.trade upgraded the Factory contract to split the single role into two distinct roles with different bit layouts, preventing users from authorizing Storage writes and requiring all account changes flow through the controller.