Vestaa exploited via leaked Permit2 signature from their own failed swap contract on Base, losing 3.1924 WETH to c0ffeebabe address.
Security & Exploits ·
Vestaa, a project on Base, lost 3.1924 WETH to an address labeled c0ffeebabe following an exploit of their swap contract. The loss occurred when a transaction reused a Permit2 signature that had leaked from Vestaa's own failed swap transaction one block prior, enabling the unauthorized transfer. Vestaa identified a bug in their contract as the source of the signature leak and stated they have shut down the affected system.
In a message addressed to the c0ffeebabe team, Vestaa acknowledged that the exploit could have resulted in larger losses and requested the return of the funds, offering to let the recipient retain a portion as a bounty. The project noted that c0ffeebabe has returned funds to affected teams on previous occasions. Vestaa provided contact information via Telegram for further discussion.
Whether the funds will be returned, and on what terms, remains unconfirmed. The specific details of the contract bug and the extent of Vestaa's remediation efforts beyond shutting down the affected system have not been disclosed.