SlowMist(@SlowMist_Team):🚨SlowMist TI Alert🚨 💸 Loss: ~24.7 ETH 🔍 Root Cause: Missing access control in order factory function `0xbde886fc` (createOrderForBuyer). It only checks `_requests[buyer].active` — no `msg.sender == buyer`, no buyer signature/nonce/authorization verification, and no check on the attacker-supplied seller. The factory then calls the whitelisted account system, deducting full ETH balances from arbitrary active buyers into new order proxies. Order init writes the attacker contract into privileged storage slot 27, passing the `abort` check and draining all ETH from each proxy. 📌 Attacker EOA: `0x77071d2bbd8f3c296c8cd7d0abd21bc172420cda` 📌 Victim Contract (Account System): `0xfcf3d97c6db4c3bf6020a2b99af074b595bda163` 📌 Vulnerable Contract (Order Factory): `0xa27bcd590195b2a9bdc29379de4f040b2d8066e0` Powered by https://t.co/Mz5jOnx997 Tx:

2026.09.09 02:25

🚨SlowMist TI Alert🚨 💸 Loss: ~24.7 ETH 🔍 Root Cause: Missing access control in order factory function `0xbde886fc` (createOrderForBuyer). It only checks `_requests[buyer].active` — no `msg.sender == buyer`, no buyer signature/nonce/authorization verification, and no check on the attacker-supplied seller. The factory then calls the whitelisted account system, deducting full ETH balances from arbitrary active buyers into new order proxies. Order init writes the attacker contract into privileged storage slot 27, passing the `abort` check and draining all ETH from each proxy. 📌 Attacker EOA: `0x77071d2bbd8f3c296c8cd7d0abd21bc172420cda` 📌 Victim Contract (Account System): `0xfcf3d97c6db4c3bf6020a2b99af074b595bda163` 📌 Vulnerable Contract (Order Factory): `0xa27bcd590195b2a9bdc29379de4f040b2d8066e0` Powered by Tx:

显示更多