POPA Recona Safe multisig lost $7.45M due to a misconfiguration on Avalanache.
a Safe multisig lost $7.45M due to a misconfiguration on Avalanache. RootCause: A Safe multisig misconfiguration on Avalanche involving unrevoked unlimited token approvals to a predictable, empty address.The 2-of-7 Safe had given unlimited spending approvals (for WAVAX, USDC, WETH.e, and BTC.b) to the address 0x3725bd4d175283108156c3f15f86e1c51266155d. On other chains (Base, Arbitrum, Ethereum), that same address held the team’s legitimate pool contract. On Avalanche, however, the address was empty. It is the deterministic address produced by Safe’s public CreateCall contract on its 13th dep…
The excerpt is quoted from a public Telegram channel, which owns its text.
Read the original post on Telegram