On October 20, 2022, Ethereum Alarm Clock's transaction scheduling protocol was exploited via a gas fee refund calculation vulnerability where the cancel() function calculated refunds too high when given inflated transaction fees, allowing attackers to call cancel with high gas prices and extract approximately 204 ETH (~$260K) in overpaid refunds.

According to Cointelegraph, a vulnerability in the Ethereum Alarm Clock service (Ethereum Alarm Clock) has been exploited, and the hacker has so far made about $260,000 in profit. According to the analysis, hackers managed to exploit a loophole in the scheduled transaction process to profit from the refund of gas fees for canceled transactions. According to Etherscan transaction history, the hackers have obtained 204 ETH, worth about $259,800. It is reported that the Ethereum alarm clock service is to allow users to schedule future transactions by pre-determining the recipient address, sending amount and transaction time.