SlowMist: EIP-7702 Account Vulnerability Exploited, 1,988.5 QNT Stolen
7x24h News
SlowMist: EIP-7702 Account Vulnerability Exploited, 1,988.5 QNT Stolen
According to SlowMist, the attacker exploited a flawed EIP-7702 account to steal 1,988.5 QNT (approximately 54.93 ETH) from the QNT reserve pool. The root cause lies in the fact that the reserve pool’s administrator EOA delegated code to the BatchExecutor contract via EIP-7702, and this BatchExecutor contract authorized the permissionless BatchCall contract as an authorized caller. Since the BatchCall.batch() function lacks any access control checks, any external caller can invoke it—ultimately resulting in the complete depletion of the reserve pool’s assets.
Navigating Web3 tides with focused insightsTechFlow News: On April 29, according to SlowMist, an attacker exploited a flawed EIP-7702 account to steal 1,988.5 QNT (approximately 54.93 ETH) from the QNT reserve pool.
The root cause lies in the fact that the reserve pool’s administrator EOA delegated code execution to the BatchExecutor contract via EIP-7702, and this BatchExecutor contract authorized the permissionless BatchCall contract as a caller. Since the BatchCall.batch() function lacks any access control checks, any external caller can invoke it—ultimately resulting in the complete depletion of assets in the reserve pool.
