QNT Reserve EIP-7702 + Permissionless `BatchCall.batch()` Drain

Source & credit. Original research reproduction (not from DeFiHackLabs). Standalone Foundry PoC, offline anvil_state.json, and full write-up: 2026-04-QNT_EIP7702_BatchCall_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/access-control/missing-auth · vuln/access-control/broken-logic · vuln/dependency/unsafe-external-call

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder. The fork is served offline from the bundled anvil_state.json (local anvil replays Ethereum state at block 24978302), so no public RPC is required. Full verbose trace: output.txt. Reconstructed BatchCall surface: BatchCall.sol (on-chain BatchCall is unverified; source is reconstructed from selectors / dispatch — the critical property is the absence of any caller auth on batch()).

Key info#

TL;DR#

1. A QNT reserve is controlled under the authority of admin EOA 0xc6ddf907….
2. That EOA is EIP-7702-delegated to BatchExecutor 0x95538e1c… (designator code 0xef0100 || delegate).
3. BatchExecutor exposes BATCHER() = BatchCall 0x044dc3… and treats that BatchCall as an authorized owner (isOwner(BatchCall) == true).
4. BatchCall.batch(address[],bytes[]) has no caller auth — any EOA can supply targets + calldatas.
5. Attacker CREATE (nonce 0) constructor drives the open batch path, transfers all 1,988.5465 QNT out of the reserve wallet, multi-hop swaps, and realizes ~54.93 ETH on the attacker EOA.

This is a smart-contract access-control bug (open batch) composed with a dangerous 7702 admin setup — not pure private-key theft. Once the EOA delegated to the bad executor design, any caller could invoke the open batch path in the admin's authority.

Root cause (both layers)#

Layer 1 — EIP-7702 admin delegation#

At fork block 24978302, admin code is the 23-byte EIP-7702 designator:

0xef010095538e1c40e82dbc9dfb2f7f88580d0d0824688e
│     └─ 20-byte BatchExecutor address
└─ EIP-7702 designator prefix

Calls to the admin EOA execute BatchExecutor code with address(this) == admin.

BatchExecutor getters (immutable / view) at that block:

Layer 2 — Permissionless BatchCall.batch()#

BatchCall is unverified. Runtime dispatch exposes:

• batch(address[],bytes[]) = 0xf38f59d7 (primary)
• secondary selector 0x4300081f

Reconstructed surface (see BatchCall.sol):

/// @notice Permissionless multi-call. No access control.
function batch(address[] calldata targets, bytes[] calldata datas) external {
    // ← no owner / role / allowlist check on msg.sender
    if (targets.length != datas.length) revert LengthMismatch();
    for (uint256 i = 0; i < targets.length; i++) {
        (bool ok, ) = targets[i].call(datas[i]);
        if (!ok) revert CallFailed(i, targets[i], datas[i]);
    }
}

Missing auth line is the entire point: there is no require(msg.sender == …) (or equivalent) anywhere in the entrypoint. The contract is a public multicall proxy that the 7702 BatchExecutor treats as a trusted BATCHER.

Attack flow#

Attacker EOA (nonce 0)
  └─ CREATE attack contract 0xf210…  (constructor = full exploit)
       ├─ CREATE intermediate 0x5a81… (nonce 1)
       ├─ Drive permissionless BatchCall under 7702 admin authority
       ├─ RESERVE executes QNT.transfer(intermediate, 1988.5465e18)
       ├─ Intermediate multi-hop swaps QNT → WETH / other → ETH
       └─ ETH paid out to attacker EOA (~54.93 ETH)

On-chain evidence (attack tx logs):

1. Custom execute event from RESERVE encoding transfer(0x5a81…, 1988.5465e18).
2. QNT Transfer(RESERVE → intermediate, 1988546547972979064297).
3. Subsequent DEX swaps (Balancer, Uniswap-style pools, Permit2, Bancor, …).
4. Attacker EOA ETH balance jumps from ~0.0128 ETH to ~54.95 ETH.

PoC strategy#

Same pattern as 2026-05-ONTR_exp: replay historical CREATE initcode at FORK_BLOCK = ATTACK_BLOCK - 1.

vm.startPrank(ATTACKER, ATTACKER);
bytes memory initcode = CREATE_INITCODE; // full tx input
address deployed;
assembly {
    deployed := create(0, add(initcode, 0x20), mload(initcode))
}
require(deployed == ATTACK_CONTRACT);

Assertions:

• RESERVE QNT balance drops by exactly 1988546547972979064297.
• Admin still has 23-byte ef0100 designator pre-attack (restored via vm.etch if the anvil dump stripped it — see caveats).
• Attacker EOA ETH increases (swap residual).

Offline reproduction#

# from registry root
_shared/run_poc.sh 2026-04-QNT_EIP7702_BatchCall_exp -vvv
# expect: [PASS] testExploit

anvil_state.json is a foundry-cache → anvil conversion of mainnet state at block 24978302, with admin 7702 designator code manually restored (cache exports often store code: 0x for designator accounts).

Remediation#

1. Never make a batch/multicall executor callable by the world if it is also a trusted BATCHER / module of a privileged 7702-delegated identity.
2. Gate batch() with a firm allowlist / owner / EIP-712 session key; default deny.
3. Prefer EIP-7702 delegates that reject unauthenticated outer callers and only accept signed user-ops / owner-initiated sessions.
4. Keep high-value reserve assets behind multi-sig / timelock that cannot be reached by a single open multicall hop.
5. Monitor 7702 designator changes on treasury / admin EOAs.

7702 / anvil caveats#

References#

• Attack tx: https://etherscan.io/tx/0x4f31f68df9f240492f13df9ab23207ea231ec1b5a89af9c31cde58e7d98cb18c
• SlowMist alert: https://x.com/SlowMist_Team/status/2049333031371210854
• EIP-7702: https://eips.ethereum.org/EIPS/eip-7702

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-04-QNT_EIP7702_BatchCall_exp (evm-hack-registry mirror).
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.