Slice (onchain commerce protocol) suffered an exploit in its FundsModule where the 0x9d2edfac function trusted release amounts returned by caller-selected source contracts without verifying that corresponding ETH or USDC was actually received. The attacker used two contracts that returned nonzero amounts while transferring no assets, enabling immediate withdrawals of ~$41k from pooled reserves to the attacker.