🚨SlowMist TI Alert🚨 💸 Unknown Gnosis Safe wallet Loss: ~$7.73M 🔍 Root Cause: In the `multicall(address, bytes[])` function of the Router contract (address `0x4f005592…`), the `_contract` parameter could be set to `address(this)`. Consequently, the `_isAuthorized` function—used for internal permission checks—would unconditionally return true. This allowed the victim Safe module contract to execute attacker-crafted malicious call data via `DelegateCall`, injecting aEthrsETH into an attacker-created liquidity pool equipped with a hook; the assets were subsequently swapped and redeemed for profit. 📌 Attacker: 0x2f7e143e27f2fa26ef3b8ac72698f1d321422f67 📌 Victim: 0x40e93a52f6af9fcd3b476aedadd7feabd9f7aba8 📌 Vulnerable Contract: 0x4f0055926c839d1d960a82cbf84e2ee933958ebc Txs: https://etherscan.io/tx/0x0e7680b06cb8a6f86c149d9ba90d98e3d334e7b072dde03909d43fcfd98a8705 https://etherscan.io/tx/0xffbc6f742c85d0c7293eca8842f66b1a72581bed1c114b52f9d6f463e5964f9a https://etherscan.io/tx/0xb95af93953fe02aeffa2abf30d8ad5fb1f92723064d12ca0dd2c14f44ee96df5 https://etherscan.io/tx/0x850342386d7446e3ce479ecc246e843961a46fa6540d279a5ef602d14deb547e Powered by http://SlowMist.AI