Post
This post by its id.
https://api.web3aggregator.io/api/v1/posts/16430 curl -H "Authorization: Bearer $W3A_API_KEY" 'https://api.web3aggregator.io/api/v1/posts/16430'Needs a key: W3A_API_KEY in your environment.
The API gives this message alone: an album's other parts are posts of their own there, linked by album.
API docsAlpsCon.ai hacked $152K
Rootcause:
Access-control / operational failure (the entry point)
The Hardhat/Anvil default account #0 (
Anyone could therefore use EIP-7702 to delegate arbitrary code to that address and execute transactions as a fully verified, whitelisted wallet.
Reward-accounting bug (the actual value extraction)
Newer reward contracts (V7–V9) recursively imported balances from earlier versions. When a fresh stake appeared in an older hub that still accepted deposits, the newer contracts multiplied the newly visible balance by the already-accumulated
This let a brand-new (flash-loan funded) stake claim the entire historical reward history (~$355K USDC), emptying the pool. The attacker then unstaked, sold the ALPS, repaid the flash loan, and kept the net ~$152K.
@EthSecurity1
Rootcause:
Access-control / operational failure (the entry point)
The Hardhat/Anvil default account #0 (
0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266) — whose private key is publicly known — was added to the production KYC whitelist in a bulk import on 2025-08-24 and left there for ~14 months.Anyone could therefore use EIP-7702 to delegate arbitrary code to that address and execute transactions as a fully verified, whitelisted wallet.
Reward-accounting bug (the actual value extraction)
Newer reward contracts (V7–V9) recursively imported balances from earlier versions. When a fresh stake appeared in an older hub that still accepted deposits, the newer contracts multiplied the newly visible balance by the already-accumulated
profitPerShare while the account’s entryProfitPerShare stayed at zero.This let a brand-new (flash-loan funded) stake claim the entire historical reward history (~$355K USDC), emptying the pool. The attacker then unstaked, sold the ALPS, repaid the flash loan, and kept the net ~$152K.
@EthSecurity1