🚨SlowMist TI Alert🚨 💸 @slice__so Loss: ~$41k 🔍 Root Cause: FundsModule’s 0x9d2edfac trusted release amounts returned by caller-selected source contracts without verifying that the corresponding ETH or USDC was actually received. In this transaction, two selected contracts returned nonzero amounts while transferring no assets. With flag=true, the function used those unbacked amounts to calculate immediate withdrawals from pooled reserves to the transaction sender. 📌 Attacker: 0xc34572ebb26b9a4c54854aae8d2347108e8c892f 📌 Victim (FundsModule Proxy): 0x61bcd1ed11fc03c958a847a6687b1875f5eacaaf 📌 Vulnerable Implementation: 0x8db3b6f51b594dc87b87a3a3b844de9c0d8d60b5 Powered by #SlowMist.AI Tx: https://basescan.org/tx/0x02b039a6345348d984e4a0b70dd233127772206e61ce82c390c4709c0b8d790a