GaslessReservoirEnabler exploit analysis

GaslessReservoirEnabler on Polygon was used to drain 8.72 WETH (~$23.8K) across 466 victims on 2026-09-21, in a single transaction (attack transaction, block 94199850). DeFiHackLabs reconstructs the drain on a Polygon fork and reproduces 2.3546 WETH from a 3-victim subset (about 27% of the WETH leg).

The Enabler exposes erc20WithTransfersAndExecute(ERC20Transfer[], ExecutionInfo[]). The ExecutionInfo leg lets the caller name a module address and arbitrary data, and the contract runs module.call(data) after checking only that the module is on moduleWhitelist and that the module is a contract. It never restricts what data may be. The live WETH token contract is itself whitelisted as a "module" at the fork block, so a caller can pass data = transferFrom(victim, attacker, amount): the Enabler becomes msg.sender to WETH, and any address that had granted the Enabler a standing WETH approval is drained. The meta-transaction signature path (executeMetaTransaction) is bypassed entirely.

DeFiHackLabs reproduces 3 victims' drains (2.3546 WETH) from real balances on the fork; the full attack drained all 466 victims in the same tx.

The fix is to require module to be a non-token contract, or to restrict data to a curated set of selectors when module is a live ERC-20.