SlowMist|8月 08, 2026 10:54
🚨SlowMist TI Alert🚨
💸 @atomic__green Loss: 29,984.27USDC
🔍 Root Cause: Signature replay in `0xa806010f` (`0x62cc...4a0`) due to missing position ID, position manager, caller, nonce, deadline, and chain ID binding in the signed digest. The same manager signature was replayed across 21 different position IDs, enabling unauthorized full LP burn (`partialBurn`) under a flashloan-manipulated price, with no TWAP or slippage checks.
📌 Attacker: `0xf8803dae13a6757e53711214769b5fb52ec26c7e`
📌 Victim Position Manager Proxy: `0xf617a3ad1f0ab9d9fe39e48d688bfe44562769d9`
📌 Vulnerable Business Contract (Proxy): `0x51ff48f2d43966be796692bdddfae96a435242a8`
📌 Vulnerable Business Logic: `0x62cc552215303341f9651e89db40e7336a394a0a`
Single signature authorized full Uniswap V3 LP position burns across 21 IDs, combined with flashloan price manipulation for ARB→USDC arbitrage profit.
Powered by http://SlowMist.AI
Tx: https://arbiscan.io/tx/0xbd4a009cd609a05f1a64458969a1e2c2065472f0ee06a322246f155be12e3a9a(SlowMist)
Share To
Timeline
HotFlash
APP
X
Telegram
CopyLink