infosec

Exploit: https://t.co/0GShR9Zemd

Attacker: https://t.co/wNvKVar2iw

The attacker invoked the execute function, that eventually calls basicSellToPool with attacker-controlled parameters.

This allowed the attacker to craft a transaction that calls the claim function on behalf of 0x Settler with the _claimTo being the attacker https://t.co/l3KbYoQ4HF

Blockaid

zora claim getting exploited: https://x.com/blockaid_/status/1915410675083444252
https://basescan.org/tx/0xf71a96fe83f4c182da0c3011a0541713e966a186a5157fd37ec825a9a99deda6

To clarify - 0x Settler contract was not exploited.

The attackers took advantage of the fact that ZORA tokens were allocated to the contract (which is permissionless and allows arbitrary calls) and were able to use it to claim it's ZORA balance.

Interesting tidbit - In this TX: https://t.co/PWd5awtLtV

The attacker moved funds to 0xf70da97812cb96acdf810712aa562db8dfa3dbef

Which is funded by 0x13c796afaabbab309047f8695e5b3e868794ae90

which can be traced to this Farcaster account:
https://t.co/9afGuAO5Pv

👀

𝖒𝖆𝖓𝖉𝖆𝖙𝖚𝖒 𝖆𝖉 𝖆𝖘𝖙𝖗𝖆

FARCASTER MENTIONED
https://x.com/blockaid_/status/1915435995660460291

it looks like the 0x Settler contract is just open season for anyone to call

Since @zora didn’t void their $ZORA airdrop allocation to smart contracts, the allocation intended for @0xProject was claimed by an “exploiter” using arbitrary calldata to the 0x Settler contract — resulting in 5.5M $ZORA being claimed and dumped.

https://t.co/MBxbcGRb3W https://t.co/9pRcP41yjR

John Doe

it looks like the 0x Settler contract is just open season for anyone to call

https://x.com/0xtroll/status/1915447634351079854?s=46