🚨SlowMist TI Alert🚨 💸 @cozyfinance Loss: ~$160k 🔍 Root Cause: The contract will automatically consider any undisputed YES = 1e18 price proposal submitted by any address via the UMA Optimistic Oracle as an external attack event. The trigger does not independently verify the authenticity of the Aave/Curve event; Cozy PToken's compensation eligibility is not tied to a snapshot of holdings prior to the event/UMA proposal. An attacker-controlled executor submitted YES = 1e18 to two permissionless UMA Optimistic Oracle requests. The triggers accepted the affirmative proposals, and after settlement the markets transitioned to TRIGGERED, enabling CPT redemption. 📌 Attacker: Tx sender 0x003FE7359A4E03C85Ac2f521eC699ED84C7c5ccB 📌 Victim: 0x17705474203f7ff7ba8a940c433ab43d1f58e249 📌 Vulnerable Contract: 0xeb6613fac35fed17c276e3fe45d67da67685f1ef, 0xacd105feea362d5c27caaba0b45f53d91b92de27, and payout implementation 0x17aff89bf88b4eb56a1bcb256ff49fa1910e8410. Transactions: https://optimistic.etherscan.io/tx/0x53b454a3f552c5498994f74ae8737faa60123cac274bdd3b0383ccb226b3f2cb https://optimistic.etherscan.io/tx/0x8761164b8947a0690b57896a8e7370dd69fe8e9137ce61e0b21ff08581a2ce60 Powered by http://SlowMist.AI(SlowMist)