On October 31, 2023, Unibot's newly-deployed unverified router contract contained a call injection vulnerability allowing attackers to insert arbitrary transferFrom() calls and drain $640,000 in approved tokens from user wallets. The stolen funds were moved to Uniswap then Tornado Cash.

According to SlowMist security alert, Unibot has been exploited, and due to the lack of necessary parameter checks, the exploiter can transfer tokens for which users have approved the Unibot contract. Please revoke approval of 0x126c9FbaB3A2FCA24eDfd17322E71a5e36E91865.