WETH (WETH)

it's happening. someone just WETH-ed their @BoredApeYC to buy a stonkbroker. can't wait to see how this plays out. https://t.co/bXdbfnJILS

⚠️ 16.623 $WETH drained on Base Chain.

An attacker exploited an unverified contract’s unrestricted external-call function to spend a victim’s existing WETH allowance.

The attacker used selector 0x42be3129 to make the vulnerable contract call WETH’s transferFrom function. Since the victim had previously approved the contract, 16.623 $WETH (~$31K) was transferred without the victim signing the exploit transaction.

Flow:

Victim → Vulnerable contract → Fresh helper → Attacker

The full amount remains in the attacker’s wallet.

A second near-identical attempt the following day only produced zero-value transfers.

The victim later requested the return of 9 $WETH and offered the remaining amount as a white-hat bonus. No refund has been observed yet

Attacker: 0xbdce6bdd52baceadd1fc91bf01f3bc6ab24df17a

Victim: 0x386218744a2053d949a1cafae0b7b49a35e03f53

Vulnerable contract: 0xa31722ca2a32695280d0e7e325b3dd6d699fc170

Exploit helper: 0x797c889d8df4498640f018d7e5d5f0df5bea6dc8

Tx: https://t.co/eeltVPKBA4

First spotted by: @SlowMist_Team