SlowMist: Unverified Contract Low-Level Call Vulnerability Leads to Theft of Approximately 16.6 WETH

TechFlow reports, August 01, according to SlowMist security team monitoring, an unverified contract suffered a theft of approximately 16.6 WETH due to an unrestricted low-level call vulnerability in selector 0x42be3129.

SlowMist stated that the vulnerability stemmed from the contract's lack of access control and validation of the target address and call data. The attacker exploited the contract's existing ERC20 allowance, bypassed owner checks, executed an unauthorized transferFrom operation, and ultimately stole the relevant assets.