Unverified Contract Vulnerability Leads to Theft of 16.6 WETH

An unverified smart contract with a low-level call flaw lost 16.6 WETH after attackers exploited missing access controls and ERC20 allowances.

Woofun AI reports that an unverified smart contract suffered a security breach due to an unrestricted low-level call vulnerability associated with selector 0x42be3129. The flaw involved a lack of access control and target data validation, allowing attackers to bypass owner checks by exploiting existing ERC20 allowances. This exploitation enabled unauthorized transferFrom operations, resulting in the theft of approximately 16.6 WETH.