POPA ReconTheRedVillage.com hacked for $80.7K
TheRedVillage.com hacked for $80.7K RootCuase: forwardRequest() is public and makes the router call any registered service with any calldata the caller passes. The router holds the "_authorizeUpgrade" role, so the attacker used it to call upgradeTo on the SeasonService UUPS proxy and point it at their own unverified implementation. That implementation contains a delegatecall backdoor gated to the attacker's tx.origin. SeasonService holds the transferERC20In/Out roles on TRVZooKeeper, the contract players approve WETH to for tournaments. About 13 minutes later, the backdoor used transferERC…
The excerpt is quoted from a public Telegram channel, which owns its text.