🚨SlowMist TI Alert🚨 💸 @SetProtocol Loss: ~5.08 ETH 🔍 Root Cause: actualizeFee() recalculated unitShares with upward rounding even though no fee was minted, raising it from 4,927 to 4,928. The attacker issued before the update and redeemed the same quantity afterward, extracting collateral from the rounding-induced unit increase. Uniswap v4 flash accounting supplied temporary liquidity to scale the exploit. 📌 Attacker (EOA): 0x506440728d84eb22809dc9464bc8189618a1c5b6 📌 Attack Contract: 0x016feaaa25ab8325e233bc8a2c25055bee0b2f6e 📌 Victim (Set Protocol Vault): 0x5b67871c3a857de81a1ca0f9f7945e5670d986dc 📌 Vulnerable Contract: 0x54e8371c1ec43e58fb53d4ef4ed463c17ba8a6be Powered by Tx:

🚨SlowMist TI Alert🚨 💸 @SetProtocol Loss: ～9.6K USD 🔍 Root Cause: Index Coop `ExchangeIssuance.issueSetForExactToken` trusted arbitrary SetToken state without locking. The function read components and units for quoting, but allowed a malicious manager pre-issue hook to inflate `positionMultiplier` via NAV `issue`/`redeem` with a fake valuation. `BasicIssuanceModule.issue` then read inflated real units from `ExchangeIssuance` via `transferFrom`, causing TOCTOU-based asset drain. 📌 Attacker: 0x0736930ae35eafefa789f11edf41d7b799e7c99d 📌 Victim: 0xc8c85a3b4d03fb3451e7248ff94f780c92f884fd (ExchangeIssuance) 📌 Malicious SetToken: 0xf7c2d0a2bf81bf803ed6e1d97c89fe3b30b06948 📌 Malicious Manager/Hook: 0x8f449d85f728c1dd6596880ba28a0b80b6a26c58 📌 Malicious Valuer: 0x388a3da33825e1f44ac71b8fd543523cdf994802 ⚠️ Impact: ExchangeIssuance lost real assets after attacker issued BHSET with 0.05 WETH, then abused hook to inflate component units ~93.66x, allowing excessive `transferFrom` during issue. Powered by Tx: