GaslessReservoirEnabler hacked, 23,000 dollars stolen

A security flaw in the GaslessReservoirEnabler contract enabled attackers to steal over $23.000 in cryptocurrency from nearly a thousand users. The perpetrator exploited existing token approvals on WETH and ZED through a gap in ownership verification.

In brief:

• A security flaw allowed a hacker to take WETH and ZED tokens from 997 wallets
• The stolen funds were consolidated and transferred via a bridge to Polygon
• The vulnerable contract did not correctly verify module addresses, allowing arbitrary callers to execute token distributions

How the attack worked

The problem lay in the erc20WithTransfersAndExecute function of GaslessReservoirEnabler. Although the contract did check which module addresses could be used, it did not tie the actual ERC20 transfer instructions to an authorised owner. This opened the door for attackers.

An attacker could thus make use of existing token approvals that users had already granted to the contract. By redirecting these approvals, WETH and ZED balances could be transferred directly from victims to the hacker, without any new trust having to be granted.

Damage and next steps

In total, tokens from 997 addresses were affected. The attacker’s wallet, known by the address 0x46f54c1a86575679fc3d29666c1717e9786279aa, consolidated all the loot and sent it to a bridge towards Polygon. The security firm SlowMist, which detected and investigated the attack, reports that the case is now known in the community.