🚨SlowMist TI Alert🚨 💸 GaslessReservoirEnabler Loss: ~$23k 🔍 Root Cause: GaslessReservoirEnabler’s erc20WithTransfersAndExecute → _executeInternal checked module addresses but did not bind ERC20 transferFrom instructions to an authorized asset owner, allowing arbitrary callers to spend victims’ existing allowances through whitelisted tokens. 📌 Attacker: 0x46f54c1a86575679fc3d29666c1717e9786279aa 📌 Victim: 997 token-holder addresses, including 0x2f785ef4f514f6b785ab93062e05cfcc937fac96 📌 Vulnerable Contract: 0x9b58fdadc16e30fba313e044bf9e88689c3f163e Impact: Existing WETH and ZED balances were transferred from token holders; proceeds were consolidated and deposited into a bridge on Polygon. Powered by http://SlowMist.AI Tx: https://polygonscan.com/tx/0x2e476745f0f546dbe4583359ea6258dfb4fababea08734f676df2e6006e1fdee