infosec

Exploit: https://t.co/0GShR9Zemd

Attacker: https://t.co/wNvKVar2iw

The attacker invoked the execute function, that eventually calls basicSellToPool with attacker-controlled parameters.

This allowed the attacker to craft a transaction that calls the claim function on behalf of 0x Settler with the _claimTo being the attacker https://t.co/l3KbYoQ4HF

Blockaid

zora claim getting exploited: https://x.com/blockaid_/status/1915410675083444252
https://basescan.org/tx/0xf71a96fe83f4c182da0c3011a0541713e966a186a5157fd37ec825a9a99deda6

it looks like the 0x Settler contract is just open season for anyone to call

Since @zora didn’t void their $ZORA airdrop allocation to smart contracts, the allocation intended for @0xProject was claimed by an “exploiter” using arbitrary calldata to the 0x Settler contract — resulting in 5.5M $ZORA being claimed and dumped.

https://t.co/MBxbcGRb3W https://t.co/9pRcP41yjR

John Doe

𝖒𝖆𝖓𝖉𝖆𝖙𝖚𝖒 𝖆𝖉 𝖆𝖘𝖙𝖗𝖆

it looks like the 0x Settler contract is just open season for anyone to call

https://x.com/0xtroll/status/1915447634351079854?s=46