Slice’s FundsModule Contract Exploit Causes About $41,000 Loss
Photo: TokenPost
An attacker exploited Slice’s FundsModule contract, causing a loss of about $41,000 after a withdrawal function accepted reported release amounts without checking that the corresponding assets had reached the contract. The function with selector 0x9d2edfac relied on release amounts reported by contracts selected by the caller. It permitted withdrawals without verifying that FundsModule had received the corresponding Ether (ETH) or USD Coin (USDC). The release amount determined how much the function would make available for withdrawal. The missing check between that figure and the assets actually received allowed funds to leave without a matching transfer into FundsModule.
Source: TokenPost
