Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Base Unverified Arbitrary CALL — Allowance Drain via 0x42be3129

1. An unverified Base contract holds a privileged pattern: a public function that performs a low-level CALL to an arbitrary target with attacker-controlled calldata (SlowMist: selector 0x42be3129). 2. The victim had approved this helper for ~16.623 WETH. 3. The attacker deploys a one-shot contract…

Aug 2026•Base•access-control•2 min read

Loss

~16.623 WETH (~$31k, SlowMist TI)

Chain

Base

Category

access-control

Date

Aug 2026

Source

Crypto Training

PoC & write-upPoC for your local evm-hack-analyzerAttack tx

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Crypto Training original detection and analysis (live Twitter/X security-alert intake — not from DeFiHackLabs). Standalone Foundry PoC, offline anvil_state.json, and full write-up: 2026-08-BaseUnverifiedArbitraryCall_a317_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/access-control/missing-auth · vuln/dependency/unsafe-external-call · vuln/logic/missing-validation

Key info#

Loss~16.623 WETH (~$31k, SlowMist TI)
ChainBase (8453)
Vulnerable contractUnverified helper 0xA31722CA2a32695280d0E7e325b3dd6d699Fc170
Victim (allowance holder)0x386218744a2053D949a1cafAE0b7B49a35e03F53
Attacker EOA0xBDCe6BDd52bacEaDd1fC91BF01F3bc6AB24df17A
Attacker deploy0x45e7503fAe45bED10Db4540DECf97FC8F84C15cC (from create)
Primary attack tx0xe831f399…7ad7 (block 49304016)
Alert[SlowMist 2026-08-01](https://x.com/SlowMist_Team/status/2083509411243299252

TL;DR#

  1. An unverified Base contract holds a privileged pattern: a public function that performs a low-level CALL to an arbitrary target with attacker-controlled calldata (SlowMist: selector 0x42be3129).
  2. The victim had approved this helper for ~16.623 WETH.
  3. The attacker deploys a one-shot contract that, during construction / entry, drives the helper’s unrestricted CALL to execute WETH.transferFrom(victim, attacker, amount).
  4. No SC ownership of the WETH was required — only the stale allowance + open CALL.

Root cause#

  • Missing auth on a helper that can perform arbitrary external calls.
  • No target / selector / calldata allowlist.
  • Combined with ERC-20 allowance previously granted to the helper, this is equivalent to “anyone can spend the victim’s allowance.”

Attack walkthrough#

  1. Victim previously approved WETH to 0xa317…c170 (allowance ≈ 16.623 WETH at block 49304015).
  2. Attacker EOA 0xbdce…f17a sends creation tx 0xe831…7ad7 with bytecode that embeds the victim address and WETH (0x4200…0006).
  3. Deployed contract interacts with the unverified helper via unrestricted CALL paths (0x42be3129 / related entrypoints).
  4. transferFrom pulls WETH from the victim to the attacker.
  5. Attacker WETH balance: 0 → 16.623029776956898128.

PoC#

BASH
cd 2026-08-BaseUnverifiedArbitraryCall_a317_exp
BASE_RPC_URL=https://mainnet.base.org forge test --match-test testExploit -vvv

Offline: dump anvil_state.json after a successful fork run (see output.txt for [PASS]).

Historical create bytecode: calldata/attack_create.hex.

References#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.