Security researcher reports MEV bot extracted 0.297 WETH from their swap and requests return, claiming to have identified a vulnerability in V3 callback validation logic.
Security & Exploits ·
A security researcher posted an on-chain message claiming a MEV bot extracted 0.297 WETH from their swap transaction and requesting its return. The researcher stated they had decompiled the bot's implementation, identified it as a proxy contract, and analyzed five associated helper contracts to understand its mechanics.
The researcher alleged a vulnerability in the bot's V3 callback validation logic, specifically noting an absence of CREATE2 validation in the callback design. However, they acknowledged that an tload(0) guard in the code mitigates the identified gap. The message was sent directly to an address they identified as controlling the MEV bot, with a request for good-faith return of the extracted funds or discussion of a bounty arrangement for the vulnerability disclosure.
What remains unclear is whether the bot operator has responded, whether any funds have been returned, and the technical validity of the researcher's claims regarding the callback vulnerability and its actual exploitability given the existing guard mechanisms.