transient storage init flag outlives the constructor and lets anyone reinitialize an ERC7579 account and drain it
מה ידוע על המתקפה?
הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
Attacker exploited Startale ERC-7579 smart-account initialization logic to take control of pre-funded counterfactual accounts as they were deployed. The initializeAccount(bytes) permitted an attacker-controlled bootstrap to execute via delegatecall, while an initialization authorization flag stored with transient storage remained set for the entire transaction. The attacker could therefore deploy a victim’s pre-funded account and reinitialize it again in the same transaction with a malicious bootstrap, allowing its assets to be swept
SlowMistתיאור המקור באנגלית
Startale’s ERC-7579 smart accounts on Ethereum were exploited. The attacker abused a transient-storage initialization flag in initializeAccount that persists for the entire transaction, allowing re-initialization with a malicious bootstrap in the same tx after factory deployment. This enabled draining ~330 pre-funded counterfactual accounts (no signatures or capital required) for a total of ~$2,876. The Soneium network itself was unaffected.
transient storage init flag outlives the constructor and lets anyone reinitialize an ERC7579 account and drain it
מה ידוע על המתקפה?
הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
Attacker exploited Startale ERC-7579 smart-account initialization logic to take control of pre-funded counterfactual accounts as they were deployed. The initializeAccount(bytes) permitted an attacker-controlled bootstrap to execute via delegatecall, while an initialization authorization flag stored with transient storage remained set for the entire transaction. The attacker could therefore deploy a victim’s pre-funded account and reinitialize it again in the same transaction with a malicious bootstrap, allowing its assets to be swept
SlowMistתיאור המקור באנגלית
Startale’s ERC-7579 smart accounts on Ethereum were exploited. The attacker abused a transient-storage initialization flag in initializeAccount that persists for the entire transaction, allowing re-initialization with a malicious bootstrap in the same tx after factory deployment. This enabled draining ~330 pre-funded counterfactual accounts (no signatures or capital required) for a total of ~$2,876. The Soneium network itself was unaffected.
