Security Incident · ETH Ecosystem
GaslessReservoirEnabler Smart Contract Vulnerability: $23.00K Reported Loss
The Polygon contract GaslessReservoirEnabler had an authorization flaw: erc20WithTransfersAndExecute → _executeInternal checked module addresses but did not bind ERC-20 transferFrom calls to an authorized asset owner.
- Reported loss
- $ 23,000
- Attack category
- Smart Contract Vulnerability
Incident Overview
An attacker could therefore spend victims’ existing allowances on whitelisted tokens (WETH and ZED). About 997 token-holder addresses were drained for roughly $23,000. The proceeds were consolidated and deposited into a bridge on Polygon.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.