SlowMist(@SlowMist_Team):🚨SlowMist TI Alert🚨 💸 GaslessReservoirEnabler Loss: ~$23k 🔍 Root Cause: GaslessReservoirEnabler’s erc20WithTransfersAndExecute → _executeInternal checked module addresses but did not bind ERC20 transferFrom instructions to an authorized asset owner, allowing arbitrary callers to spend victims’ existing allowances through whitelisted tokens. 📌 Attacker: 0x46f54c1a86575679fc3d29666c1717e9786279aa 📌 Victim: 997 token-holder addresses, including 0x2f785ef4f514f6b785ab93062e05cfcc937fac96 📌 Vulnerable Contract: 0x9b58fdadc16e30fba313e044bf9e88689c3f163e Impact: Existing WETH and ZED balances were transferred from token holders; proceeds were consolidated and deposited into a bridge on Polygon. Powered by https://t.co/Mz5jOnx997 Tx:

2026.09.22 02:42

🚨SlowMist TI Alert🚨 💸 GaslessReservoirEnabler Loss: ~$23k 🔍 Root Cause: GaslessReservoirEnabler’s erc20WithTransfersAndExecute → _executeInternal checked module addresses but did not bind ERC20 transferFrom instructions to an authorized asset owner, allowing arbitrary callers to spend victims’ existing allowances through whitelisted tokens. 📌 Attacker: 0x46f54c1a86575679fc3d29666c1717e9786279aa 📌 Victim: 997 token-holder addresses, including 0x2f785ef4f514f6b785ab93062e05cfcc937fac96 📌 Vulnerable Contract: 0x9b58fdadc16e30fba313e044bf9e88689c3f163e Impact: Existing WETH and ZED balances were transferred from token holders; proceeds were consolidated and deposited into a bridge on Polygon. Powered by Tx: