borodutch

clever, someone claimed the 0x Settler contract's $ZORA airdrop. 

your airdrop is probably safe, this only impacts smart contracts that can make arbitrary calls, like the Settler. since the Zora claim contract lets you send to any address and the Settler makes calls with user provided calldata, the attacker crafted a call that claimed to their own address. the bug is in the interaction between the two contracts.

https://x.com/blockaid_/status/1915404515307569396

unpopular opinion: this is *not* a hack

the settler's smart contract *intends* to do this and @zora claiming that this is a hack does not sit right

it is similar to how when cryptopunks (or apes, can't remember) launched their erc20 and someone flash-loaned eth, bought nfts, got drop, sold drop and returned the loan within the same tx

it's all fair play

🚨Our exploit detection system had identified an attacker exploiting the @zora claim contract for @0xProject's allocation

$128k in $ZORA had been stolen https://t.co/hzJiqFApSG

0x Settler is, as always, safe 🛡️

Zora set an airdrop allocation to the Settler contract. 0x Settler is permissionless and designed to make arbitrary calls - its intended purpose is to settle trades for 0x APIs. If you send Settler tokens directly without using 0x API, someone

cto @ bwl.gg, 100M+ users (bdut.ch) 🙏 $eggs is life

Not an unpopular opinion.
https://x.com/0xproject/status/1915457516697510195?s=46