Arbitrage bot on Base drained via unprotected function
Security & Exploits ·
An attacker exploited an access control gap in a private Uniswap V3 arbitrage bot on Base, withdrawing roughly $31.7K in a single transaction.
The exploit centered on an arbitrary-call function in the bot's contract that lacked proper permission checks, according to a report shared on X. Without this protection, an outside party was able to invoke the function directly and route the contract's holdings to an address of their choosing, rather than restricting the call to the bot's intended owner or operator.
The stolen funds amounted to 16.62 WETH, valued at approximately $31.7K at the time of the transfer. This is a comparatively small sum relative to major DeFi exploits, but it illustrates a recurring failure mode in automated trading infrastructure: contracts built to execute fast, permissionless-looking calls for arbitrage or MEV strategies can become liabilities if the functions meant to trigger trades are not locked down to authorized callers.
The affected contract's activity is visible on basescan.org, where the transaction tied to the drain can be traced on Base's public ledger. The incident is corroborated by a separate account describing the same mechanism, an access-control vulnerability allowing an unprotected arbitrary-call function to be triggered, resulting in the same approximate loss figure.
Base, the Ethereum Layer 2 network on which the bot operated, has been the subject of broader infrastructure activity in recent periods, including efforts summarized in a general overview of the chain's architecture and ecosystem, found at leviathan.news. That context is unrelated to this specific exploit but reflects the chain's growing footprint as a venue for both retail and automated trading activity, which increases the surface area for contract-level vulnerabilities like the one exploited here.
It remains unclear who operated the bot, whether the exploited contract was custom-built or based on a shared template, and whether the attacker has been identified. No information has been provided on whether funds will be recovered or whether other bots using similar unprotected call patterns on Base have been checked for the same weakness.