TechFlow News: On April 29, according to SlowMist, an attacker exploited a flawed EIP-7702 account to steal 1,988.5 QNT (approximately 54.93 ETH) from the QNT reserve pool.
The root cause lies in the fact that the reserve pool’s administrator EOA delegated code execution to the BatchExecutor contract via EIP-7702, and this BatchExecutor contract authorized the permissionless BatchCall contract as a caller. Since the BatchCall.batch() function lacks any access control checks, any external caller can invoke it—ultimately resulting in the complete depletion of assets in the reserve pool.
Add to Favorites
Share to Social Media
