Digital Asset
Intelligence
Security Incident · ETH Ecosystem

GaslessReservoirEnabler Smart Contract Vulnerability: $23.00K Reported Loss

·Historical incident record

Incident Overview

The Polygon contract GaslessReservoirEnabler had an authorization flaw: erc20WithTransfersAndExecute → _executeInternal checked module addresses but did not bind ERC-20 transferFrom calls to an authorized asset owner. An attacker could therefore spend victims’ existing allowances on whitelisted tokens (WETH and ZED). About 997 token-holder addresses were drained for roughly $23,000. The proceeds were consolidated and deposited into a bridge on Polygon.

Sources & References

Original incident referencehttps://x.com/SlowMist_Team/status/2102227043979313539 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Fetch.ai

    Attack methodPrivate Key Leakage
    Reported loss$ 1,530,000
  2. Incident date
    Target

    NuNet

    Attack methodPrivate Key Leakage
    Reported loss$ 462,730
  3. Incident date
    Target

    Duelbits

    Attack methodPrivate Key Leakage
    Reported loss$ 7,000,000
  4. Incident date
    Target

    DoinGud

    Attack methodSmart Contract Vulnerability
    Reported loss$ 35,486
  5. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 265,000