Slice.so's FundsModule exploited for $42K on Base via unverified release function that failed to validate slicer contracts before crediting payouts.
Security & Exploits ·
A vulnerability in Slice.so's FundsModule on Base resulted in the loss of approximately $42,000 in user funds. The exploit targeted a release function that failed to validate whether caller-supplied addresses were legitimate Slicer contracts before crediting payouts, allowing an attacker to withdraw assets that belonged to store owners.
The attack unfolded in two stages. First, the attacker triggered the release of unclaimed sales revenue from roughly 70 real Slice stores, causing those funds to accumulate in the FundsModule and be credited to store owners' accounts while remaining in the contract. The attacker then submitted a fake slicer contract that reported the module's entire balance—8.72 ETH and 19.8K USDC—as its payout, executing a withdrawal of those funds in the same transaction. The vulnerable implementation contract remained unverified at the time of the breach.
Slice.so paused and upgraded the FundsModule approximately 1.5 hours after the exploit was detected. The team subsequently offered the attacker a 10% bounty on-chain, though whether the offer was accepted remains unclear. The core issue—absent validation of slicer contract legitimacy and actual fund receipt—has been addressed in the patched implementation, but the initial design flaw exposed a material risk to protocol users.