SlowMist|Sep 11, 2026 06:43
🚨SlowMist TI Alert🚨
💸 $OMNI404 Loss: 2.4 WETH
🔍 Root Cause: In `_transfer()` of OMNI404 (O404), NFT mint/burn counts are derived only from `(balanceOf / units)` integer differences before/after the ERC20 transfer.
OMNI404's `transfer(address,uint256)` treats values ≤ 50 as ERC721 token IDs, but also transfers a fixed 1e18 OMNI404 units. Uniswap V3 exact-output swaps calling `transfer(recipient, 1/2/.../21)` received 1e18 OMNI404 per call while the pool accounted only wei-level amounts, enabling flash-loan assisted profit.
📌 Attacker: 0xfb26db4eab18cb50d29ff431888dd643a7e9c9f8
📌 Victim Pool: 0xb3f613b9bc84ddb29d78fa4685b01d98412bba0b
📌 Vulnerable Contract: 0xd5c02bb3e40494d4674778306da43a56138a383e
Powered by http://SlowMist.AI
Tx: https://etherscan.io/tx/0x4cbc3d8db832eb5442ce1c11d79fda05cafabfe7906933ed25881d60bf41d6f3(SlowMist)
Share To
Timeline
HotFlash
APP
X
Telegram
CopyLink