Телеграм канал «EthSecurity»

a Safe multisig lost $7.45M due to a misconfiguration on Avalanache.

RootCause: A Safe multisig misconfiguration on Avalanche involving unrevoked unlimited token approvals to a predictable, empty address.The 2-of-7 Safe had given unlimited spending approvals (for WAVAX, USDC, WETH.e, and BTC.b) to the address 0x3725bd4d175283108156c3f15f86e1c51266155d.
On other chains (Base, Arbitrum, Ethereum), that same address held the team’s legitimate pool contract. On Avalanche, however, the address was empty. It is the deterministic address produced by Safe’s public CreateCall contract on its 13th deployment, and CreateCall had never been used on Avalanche. The approvals (set in a batch transaction on 2026-03-07) were never revoked.
Because the target address was unoccupied, anyone could deploy their own contract there (via the Safe singleton factory + CreateCall) and then use the existing unlimited allowances to drain the Safe’s tokens. An attacker did exactly that; an MEV bot front-ran the drain in the same block.
@EthSecurity1

- Device hardening & factory reset guides - link

- Top 5 Crypto & Web3 Hacks That Started With Phishing - link

- Cross-Function Reentrancy: When Functions Betray Each Other 
@EThSecurity1

- Moving from EVM to Move Part 1 

- Top 25 MCP Vulnerabilities - link

@EthSecurity1

X 100 hacked for $4.75M

Rootcause : Anyone could instantly join the Senate by freezing X tokens (and paying a small candidacy fee, reported as ~100 X). Membership was based on the current frozen stake. There was no snapshot of balances/voting power and no timelock (or other delay) on proposals.
A proposal could be created, voted on (with the newly acquired majority), and executed in the same transaction, including calls that invoked the treasury’s own swap functions (e.g., v3Swap).
This allowed the attacker to:
1. Flash-borrow USDT (via Aave), buy X tokens, and distribute/freeze them across controlled contracts to seize 2 of the 3 Senate seats.
2. Immediately propose + vote + execute a malicious proposal that forced the Freezer to swap a large amount of treasury X tokens into a freshly created, attacker-controlled (and empty/manipulated) PancakeSwap V3 X-USDT pool with min-output set near zero.
3. Withdraw the liquidity from that pool, sell the recovered X on legitimate markets, repay the flash loan, and keep the profit (~$4.75–4.85M USDT range reported across related alerts).
@EthSecurity1

- The Crypto Threat Landscape: Threats and Exploits Targeting Crypto Users - link

- Blockchain Forensics: A Practical Guide to Tracing Stolen Funds

- Blockchain Forensics: Attribution Techniques and the Role of OSINT

- Blockchain Forensics: Advanced Blockchain Forensics Techniques and Additional Resources
@EthSecurity1

All versions of self-hosted GitLab from 12 years ago up to now are vulnerable.


@EthSecurity1

https://blog.railway.com/p/security-disclosure-wednesday-october-21st
@EthSecurity1