🚨SlowMist TI Alert🚨
💸 Loss: 14.411518807585587 ETH
🔍 Root Cause: Storage slot collision between `ATOHook.rewards` mapping slot and Solady `ReentrancyGuard` fixed slot (`0x02215292eb9609279094554c6e223f800950648ddfa3da30329838d6c170928d`). The `nonReentrant` modifier in `getReward()` writes sentinel value `0xffffffffffffff` to the guard slot, which is simultaneously read as `rewards[attackContract]` due to the collision. This inflated reward is paid as ETH each call, allowing 200 repeated claims.
📌 Attacker (EOA): 0x2d2aafc193c24e59bd16139056ac9b4df4d37ad0
📌 Victim Contract: 0xa10de71ddb4e0d51938ef6e0118822e157a62888
📌 Attack Contract: 0x2441e480f62bf609a08da09143e4baf8a817d757
Storage collision between reward accounting and reentrancy guard enables unlimited reward drainage.
Powered by #
SlowMist#.AI