Пост
Цей пост за його id.
https://api.web3aggregator.io/api/v1/posts/17862 curl -H "Authorization: Bearer $W3A_API_KEY" 'https://api.web3aggregator.io/api/v1/posts/17862'Потрібен ключ: W3A_API_KEY в оточенні.
API віддає одне це повідомлення: інші частини альбому там — окремі пости, пов'язані полем album.
Документація APIa Safe multisig lost $7.45M due to a misconfiguration on Avalanache.
RootCause: A Safe multisig misconfiguration on Avalanche involving unrevoked unlimited token approvals to a predictable, empty address.The 2-of-7 Safe had given unlimited spending approvals (for WAVAX, USDC, WETH.e, and BTC.b) to the address
On other chains (Base, Arbitrum, Ethereum), that same address held the team’s legitimate pool contract. On Avalanche, however, the address was empty. It is the deterministic address produced by Safe’s public CreateCall contract on its 13th deployment, and CreateCall had never been used on Avalanche. The approvals (set in a batch transaction on 2026-03-07) were never revoked.
Because the target address was unoccupied, anyone could deploy their own contract there (via the Safe singleton factory + CreateCall) and then use the existing unlimited allowances to drain the Safe’s tokens. An attacker did exactly that; an MEV bot front-ran the drain in the same block.
@EthSecurity1
RootCause: A Safe multisig misconfiguration on Avalanche involving unrevoked unlimited token approvals to a predictable, empty address.The 2-of-7 Safe had given unlimited spending approvals (for WAVAX, USDC, WETH.e, and BTC.b) to the address
0x3725bd4d175283108156c3f15f86e1c51266155d.On other chains (Base, Arbitrum, Ethereum), that same address held the team’s legitimate pool contract. On Avalanche, however, the address was empty. It is the deterministic address produced by Safe’s public CreateCall contract on its 13th deployment, and CreateCall had never been used on Avalanche. The approvals (set in a batch transaction on 2026-03-07) were never revoked.
Because the target address was unoccupied, anyone could deploy their own contract there (via the Safe singleton factory + CreateCall) and then use the existing unlimited allowances to drain the Safe’s tokens. An attacker did exactly that; an MEV bot front-ran the drain in the same block.
@EthSecurity1