An attacker exploited two flaws in an Argent-style smart wallet system. The recovery module’s unrestricted setter allowed a crafted recovery period to wrap the deadline timestamp into the past, enabling same-transaction recovery and ownership change with a valid guardian signature. The execution module also failed to reject reuse of identical signed payloads (executed 19 times in one tx and 9 times in another). The attacker used the repeated executions to trade against a low-liquidity MARK/WETH pool, resulting in a loss of approximately $59,800.