🚨SlowMist TI Alert🚨 💸 @DoinGudHQ Loss: ~$35k 🔍 Root Cause: In `acceptOffer` (0x5c924960) of Implementation 0x123aafc8d0a07ce1a146e53aa899e77f21a2dde1, after transferring `offer.price` USDC to `msg.sender`, the offer record is never deleted or zeroed — the swap-and-pop logic that `cancelOffer` performs is missing. This is compounded by absent checks: no `offerer != msg.sender` restriction and no `offerAmount > 0` requirement. An `amount=0` input also defeats `_updateListingAfterTransfer` cleanup (`0 > 0` is false), so the same offer can be replayed with identical calldata, paying out the full price each time. 📌 Attacker: 0xb8c717239bcace558c3a8dc471c16e07bf57a1eb (EOA) / 0xe588834aa3161a0720e8f6bf223748d6098a4b76 📌 Victim: 0xe3a161edd679fc5ce2db2316a4b6f7ab33a8ed6a 📌 Vulnerable Contract: 0x123aafc8d0a07ce1a146e53aa899e77f21a2dde1 Impact: Two replayed `acceptOffer` calls drained the contract's entire escrow balance (70,973.871434 USDC outflow in one tx); attacker profited ~35,380 USDC with zero NFT or principal, funded via flash loan. Powered by Tx: