Private MEV arbitrage bot on Base exploited via unprotected arbitrary-call function, draining 16.62 WETH (~$31.7K) through access control vulnerability.
Security & Exploits ·
A private MEV arbitrage bot deployed on Base lost approximately 16.62 WETH (worth roughly $31,700) on July 30 due to an access control vulnerability. The bot contract exposed a function with no permission checks that allowed callers to execute arbitrary code and forward output to themselves, while a separate owner-gated function remained protected.
The attacker exploited this gap by deploying a helper contract and calling the unprotected function with instructions to transfer WETH directly from the bot's owner account. The bot had been pre-approved by its owner to move up to 16.62 WETH, and the vulnerability allowed the attacker to invoke that transfer without authorization. The entire amount was drained in a single transaction.
The asymmetry in the bot's access controls—with one function guarded and another completely open—suggests the developer may have missed securing the arbitrary-call functionality. No details have emerged about whether the owner has initiated recovery efforts or whether similar bots share the same design flaw.